{"id":"CVE-2026-86218","kind":"vulnerability","aliases":["CVE-2026-86218"],"related":[],"title":"n-able n-central: N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14","description":"N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"N-able N-central, a remote monitoring and management server used by managed service providers, has a static code injection flaw. Per the sources an unauthenticated attacker can trigger remote code execution, and CISA lists it as actively exploited.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-09-08T00:00:00+00:00","products":[{"name":"N-able N-central","fixed":["2026.3.1.14","2026.4.0.27"],"affected":"< 2026.3.1.14","ecosystem":"vendor"},{"name":"n-able n-central","fixed":["2026.3"],"affected":"< 2026.3","ecosystem":"vendor"},{"name":"n-able n-central","fixed":[],"affected":"= 2026.3","ecosystem":"vendor"},{"name":"N-able N-central","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","msp","n-able","n-central","rmm","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Self-hosted: sign in to N-central and open Help > Version Information; anything older than build 2026.3.1.14 (2026.3 base, HF1-HF3, or earlier) is exposed. As a System/Product Administrator you can also see it under System Settings > N-central Server > Version Management. Hosted N-central (NCOD) is patched by N-able. Vendor pages do not name specific exposed interfaces; treat any internet-reachable N-central web interface as in scope (Shadowserver counted 218 unpatched instances on 2026-09-12).","fix":"Upgrade self-hosted N-central to 2026.3 HF4 (2026.3.1.14) or 2026.4.0.27 (direct upgrade from 2025.4, 2026.1-2026.3 and hotfixes). No workaround is documented by N-able. Per CISA, also do forensic triage for compromise before the patch, and stop using the product if mitigations are unavailable.","status":"open","published_at":"2026-09-06T03:17:17+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T22:30:20+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-23T22:30:20Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade N-central to 2026.3.1.14 or 2026.4.0.27 or later, per the affected range below 2026.3.1.14.\nFollow vendor mitigation instructions and CISA BOD 26-04 guidance if the upgrade cannot be done now.","reach":"internet","title":"N-able N-central: pre-auth code injection lets attackers run code, exploited","impact":"high","summary":"N-able N-central, a remote monitoring and management server used by managed service providers, has a static code injection flaw. Per the sources an unauthenticated attacker can trigger remote code execution, and CISA lists it as actively exploited.","category":"vendor","who_cares":["n-able","n-central","msp","self-hosted","rmm"],"confidence":0.8,"needs_auth":"no","worst_case":"unauthenticated attacker runs code on the N-central server","analyst_note":"Confirm how_to_check (version command or exposure test) and whether the vendor advisory names exposed interfaces; see CISA KEV entry for CVE-2026-86218 and the N-able advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000538,"input_tokens":3133,"output_tokens":449,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm how_to_check (version command or exposure test) and whether the vendor advisory names exposed interfaces; see CISA KEV entry for CVE-2026-86218 and the N-able advisory.","search":"'-04':151C,177C,208C '-2026':29A,32A '-86218':30A,33A '2026.3.1.14':27A '26':150C,176C,207C 'abl':3A,62B,73B,114C 'able':36A,42A,48A,54A 'accord':140C 'action':136C 'activ':110B 'adher':204C 'affect':22A 'allow':126C 'appli':137C 'applic':174C 'asset':198C 'attack':99B 'auth':16A 'authent':130C 'base':155C 'bod':149C,175C,206C 'central':6A,9A,25A,39A,45A,51A,57A,65B,76B,117C 'cisa':106B,134C,147C,164C 'cloud':180C 'code':18A,91B,103B,121C,132C 'complianc':145C 'contain':118C 'could':125C 'cve':28A,31A 'discontinu':183C 'ensur':144C,203C 'evalu':196C 'execut':19A,104B,133C 'exploit':58B,111B 'exposur':201C 'flaw':93B 'follow':173C 'forens':166C 'guidanc':162C,178C 'guidelin':210C 'host':69B 'inject':92B,122C 'instruct':143C 'internet':200C 'issu':21A 'list':107B 'manag':81B,85B 'mitig':138C,189C 'monitor':79B 'msp':59B 'n':2A,5A,8A,24A,35A,38A,41A,44A,47A,50A,53A,56A,61B,64B,72B,75B,113C,116C 'n-abl':1A,60B,71B,112C 'n-able':34A,40A,46A,52A 'n-central':4A,7A,23A,37A,43A,49A,55A,63B,74B,115C 'note':161C,172C 'patch':209C 'per':94B 'pre':15A,129C 'pre-auth':14A 'pre-authent':128C 'priorit':152C 'product':187C 'provid':87B 'remot':17A,78B,102B,131C 'requir':135C,168C 'respons':194C 'risk':157C 'rmm':66B 'secur':153C 'see':158C,169C 'self':68B 'self-host':67B 'server':82B 'servic':86B,181C 'sourc':96B 'stakehold':192C 'static':90B,120C 'triag':167C 'trigger':101B 'unauthent':98B 'unavail':191C 'updat':154C 'url':159C,170C 'use':83B,184C 'vendor':70B,142C 'vulner':11A,123C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-06T03:17:17+00:00","kev":{"dateAdded":"2026-09-08","dueDate":"2026-09-11","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-86218","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86218","severity":null,"published_at":"2026-09-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-86218:89","url":null,"severity":null,"published_at":"2026-10-23T21:30:45+00:00","modified_at":"2026-10-23T21:30:45+00:00","first_seen_at":"2026-10-23T21:30:45+00:00","fetched_at":"2026-10-23T21:30:45+00:00","note":"Read N-able HF4 release notes and status post, 2026.4 notes, Cyber Centre AV26-885, THN. Affected floor unknown (only 'prior to 2026.3.1.14'). Exploitation conflict: N-able notes say unconfirmed, Cyber Centre/KEV say exploited; kept true per KEV. Related CVE-2026-86206/86207 (auth bypass, fixed in HF3). Did not search X beyond the two Shadowserver posts already linked. No PoC link found."},{"source":"analyst","external_id":"CVE-2026-86218:243","url":null,"severity":null,"published_at":"2026-10-23T22:31:40+00:00","modified_at":"2026-10-23T22:31:40+00:00","first_seen_at":"2026-10-23T22:31:40+00:00","fetched_at":"2026-10-23T22:31:40+00:00","note":"Return visit: nothing new in sources. Triage had blanked how_to_check; restored it from N-able docs (Help > Version Information, Version Management). Vendor pages name no exposed interfaces; no workaround documented."},{"source":"nvd","external_id":"CVE-2026-86218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86218","severity":null,"published_at":"2026-09-06T03:17:17+00:00","modified_at":"2026-09-09T05:18:19+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":369,"url":"https://x.com/Shadowserver/status/2098849487775031340","title":"@Shadowserver: IP data in Vulnerable HTTP reporting tagged 'cve-2026-86218': https://t.co/qxv0G","kind":"post","source":"x","text":"IP data in Vulnerable HTTP reporting tagged 'cve-2026-86218': https://t.co/qxv0Gv5ELc\n\n218 out of 1399 seen in total. This is one week after exploitation activity was first reported publicly. \n\nPatch info: https://t.co/Z1lWNfAD3Q\n\nBackground on incidents:  https://t.co/gi4tvLPuwQ\n\nlikes 0 reposts 1","published_at":"2026-09-12T19:01:27+00:00","relation":"discussion","confidence":null,"note":"@Shadowserver"},{"id":370,"url":"https://x.com/Shadowserver/status/2098849484767682931","title":"@Shadowserver: Still 218 instances of N-able N-central seen unpatched  to CVE-2026-86218 pre-au","kind":"post","source":"x","text":"Still 218 instances of N-able N-central seen unpatched  to CVE-2026-86218 pre-auth RCE that is exploited in the wild &amp; on @CISACyber KEV. Top: US (141)\n\nStats - World Map view: https://t.co/X0pOrgWfPQ\n\nTracker: https://t.co/XoqROt23pN https://t.co/jcgTRBHBYw\n\nlikes 6 reposts 5","published_at":"2026-09-12T19:01:26+00:00","relation":"discussion","confidence":null,"note":"@Shadowserver"},{"id":1053,"url":"https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF4_Release_Notes.htm","title":"N-central 2026.3 HF4 Release Notes","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1055,"url":"https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/","title":"N-central 2026.3 Hotfix 4 – CVE-2026-86218","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1057,"url":"https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.4_Release_Notes.htm","title":"N-central 2026.4 Release Notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1058,"url":"https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","title":"Cyber Centre AV26-885","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1059,"url":"https://thehackernews.com/2026/09/n-able-n-central-pre-auth-rce-flaw.html","title":"The Hacker News: N-central pre-auth RCE","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1497,"url":"https://documentation.n-able.com/N-central/userguide/Content/Introduction-GettingStarted/Help_Menu.htm","title":"N-central Help Menu (Version Information)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}