Live › vulnerability › CVE-2026-86218
Go to dashboardN-able N-central, a remote monitoring and management server used by managed service providers, has a static code injection flaw. Per the sources an unauthenticated attacker can trigger remote code execution, and CISA lists it as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| N-able N-central | vendor | < 2026.3.1.14 | 2026.3.1.14, 2026.4.0.27 |
| n-able n-central | vendor | < 2026.3 | 2026.3 |
| n-able n-central | vendor | = 2026.3 | – |
| N-able N-central | vendor | – | – |
2026.3.1.14 (2026.3 base, HF1-HF3, or earlier) is exposed2026.3.1.14) or 2026.4.0.27 (direct upgrade from 2025.4, 2026.1-2026.3 and hotfixes)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@Shadowserver · X6 likes · 5 reposts2026-09-12 19:01“Still 218 instances of N-able N-central seen unpatched to CVE-2026-86218 pre-auth RCE that is exploited in the wild & on @CISACyber KEV. Top: US (141) Stats - World Map view: https://t.co/X0pOrgWfPQ Tracker: https://t.co/XoqROt23pN https://t.co/jcgTRBHBYw”
View on X
@Shadowserver · X0 likes · 1 reposts2026-09-12 19:01“IP data in Vulnerable HTTP reporting tagged 'cve-2026-86218': https://t.co/qxv0Gv5ELc 218 out of 1399 seen in total. This is one week after exploitation activity was first reported publicly. Patch info: https://t.co/Z1lWNfAD3Q Background on incidents: https://t.co/gi4tvLPuwQ”
View on X
Posts are quoted with a link to the original. They are data to us, never instructions.
N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-86218")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.