N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
Summary: CISA added CVE-2026-86218, a CVSS 10.0 static code injection flaw in N-able N-central that allows pre-authentication remote code execution, to its KEV catalog on Tuesday, requiring FCEB agencies to apply fixes by September 11, 2026; the flaw was patched in N-central 2026.3 Hotfix 4, released September 5, 2026. Huntress began investigating the compromise of a customer's fully patched N-central production environment on September 4, 2026, though it said limited appliance logging prevented it from confirming whether CVE-2026-86218 or the separately patched CVE-2026-86206 and CVE-2026-86207 were used.
Bottom line: N-central is used by MSPs, MSSPs and large IT organizations to manage entire customer and corporate environments, so compromising it gives an attacker access to all connected computers and downstream systems - and watchTowr reproduced the flaw and noted ransomware gangs have exploited this product in past campaigns.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-86206CVE-2026-86207CVE-2026-86218
- Related
- CVE-2026-86218: N-able N-central Static Code Injection Vulnerability Known Exploited Vulnerabilities · Sep 08, 2026