N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
Summary: N-able released a fourth hotfix in five weeks for its N-central RMM platform, addressing CVE-2026-86218, a pre-authentication remote code execution flaw with a CVSS 4.0 score of 10.0 that affects every build before 2026.3.1.14, including servers updated to Hotfix 3 about eight hours earlier. N-able's release notes say there are no confirmations of exploitation in production, while its incident notice states the flaw has been observed being exploited in the wild, and Huntress said it has not reproduced the CVE or seen compromises definitively attributable to it.
What's compelling: A maximum-severity, unauthenticated RCE in the tool MSPs use to reach customer endpoints is the primary attack vector Huntress names for internet-exposed consoles, and N-able's own channels disagree on whether it is already being exploited. Last summer's N-central flaws ended with attackers using Take Control to register Cloudflare tunnels on managed endpoints and CISA adding both CVEs to its Known Exploited Vulnerabilities catalog.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-86218
- Related
- CVE-2026-86218: N-able N-central Static Code Injection Vulnerability Known Exploited Vulnerabilities · Sep 08, 2026N-able N-central Pre-Auth RCE Flaw Exploited in the Wild Cyber Risks ·