N-able N-central CVSS 10.0 RCE (CVE-2026-86218)
N-able N-central Hit by Actively Exploited CVSS 10.0 RCE Flaw
Related Entities
Products & Tech
CVE Identifiers
Full Report
Executive Summary
N-able has issued an urgent security advisory for a critical vulnerability in its N-central remote monitoring and management (RMM) platform. The flaw, tracked as CVE-2026-86218, is a pre-authentication remote code execution (RCE) vulnerability with a CVSS score of 10.0, the maximum possible severity. The company has confirmed that this zero-day is being actively exploited in the wild. Successful exploitation allows an unauthenticated attacker to execute arbitrary code on a vulnerable N-central server, granting them complete control over the RMM platform and, by extension, privileged access to all downstream client endpoints managed by it. This represents a significant supply chain risk for Managed Service Providers (MSPs) and their customers. N-able has released Hotfix 4 (build 2026.3.1.14) to address the issue and is urging all on-premises customers to patch immediately.
Vulnerability Details
CVE-2026-86218 is a pre-authentication RCE vulnerability in the N-able N-central platform. Technical details of the flaw have not been publicly disclosed by N-able to prevent further exploitation. However, its classification as a pre-auth RCE with a CVSS 10.0 score indicates that an attacker requires no prior access or credentials and can exploit the flaw remotely over the network to gain full control of the server.
This incident is the culmination of a series of security failures for the product. On September 5, 2026, N-able patched two other flaws:
- CVE-2026-86206: An access control filter bypass.
- CVE-2026-86207: An authentication bypass.
Security firm Huntress had analyzed these earlier flaws and developed a PoC that chained them to create unauthorized administrative accounts. However, the system patched against these two vulnerabilities remained exposed to the more severe RCE flaw, CVE-2026-86218, necessitating the release of a fourth hotfix.
Affected Systems
- Product: N-able N-central
- Affected Versions: All on-premises builds prior to
2026.3.1.14. - Deployment: The vulnerability specifically impacts on-premises deployments. N-able's hosted cloud (NCOD) instances have been patched by the vendor.
Exploitation Status
N-able has directly confirmed to customers that CVE-2026-86218 is being actively exploited in the wild. This makes patching an urgent priority. The earlier vulnerabilities, CVE-2026-86206 and CVE-2026-86207, were also under investigation by security researchers, with Huntress demonstrating a working exploit chain before the patch for the RCE was released.
Impact Assessment
A compromise of an RMM platform like N-central is a worst-case scenario for an MSP. Attackers who gain control of the central management server can:
- Deploy malware, including ransomware, to every client managed by the MSP.
- Steal sensitive data from the MSP and its entire client base.
- Establish persistent access within dozens or hundreds of downstream networks.
- Use the MSP's trusted infrastructure to launch further supply chain attacks.
The impact is not limited to the MSP but extends to all of its customers, creating a massive blast radius from a single point of failure. This is the same attack pattern seen in the 2021 Kaseya VSA incident, which had widespread consequences.
Cyber Observables — Hunting Hints
Security teams managing N-able N-central servers should hunt for the following activity:
w3wp.execmd.exe, powershell.exe, or cscript.exe.Detection & Response
- Check for Unauthorized Accounts: Immediately audit all user accounts within the N-central platform, paying close attention to accounts with administrative privileges. Look for recently created accounts that are not associated with legitimate administrators.
- Analyze Web Logs: Review IIS logs on the N-central server for any suspicious access patterns around the dates of September 4-6, 2026, and onwards. Look for anomalous URI requests or requests from untrusted IP ranges.
- Monitor Process Activity: Use an EDR tool to monitor the N-central server for any suspicious process chains. The IIS worker process (
w3wp.exe) should not be spawning command shells or downloading external files. - Isolate and Investigate: If a compromise is suspected, immediately isolate the N-central server from the network to prevent further access to downstream clients. Preserve logs and system images for forensic analysis before rebuilding the server.
Mitigation
- Apply Hotfix 4 Immediately: The top priority is to update all on-premises N-able N-central instances to build
2026.3.1.14or later. This hotfix is cumulative and addresses CVE-2026-86218, CVE-2026-86206, and CVE-2026-86207. - Restrict Access: Do not expose the N-central management interface directly to the public internet. Access should be restricted to trusted IP addresses using a firewall or VPN. This is a critical mitigating control that would have prevented exploitation in many cases.
- Implement MFA: Enforce multi-factor authentication for all accounts accessing the N-central platform. While this may not have stopped the pre-authentication RCE, it is a critical defense against other attack vectors like the auth bypass flaw (CVE-2026-86207).
- Assume Compromise and Hunt: Given the active exploitation, organizations should assume they may have been compromised before patching and actively hunt for indicators of compromise as described in the Detection section.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Applying Hotfix 4 (build 2026.3.1.14) is the only way to remediate the RCE vulnerability.
Restricting network access to the N-central web interface to only trusted IP addresses is a critical compensating control that can prevent exploitation.
Regularly auditing N-central logs for unauthorized account creation or suspicious activity can help detect a compromise.
Multi-factor Authentication
Enforcing MFA on all N-central accounts helps protect against credential-based and authentication bypass attacks.
D3FEND Defensive Countermeasures
The most critical and immediate action for all organizations using on-premises N-able N-central is to apply Hotfix 4 (build 2026.3.1.14). Given that CVE-2026-86218 is a pre-authentication RCE being actively exploited, this is an emergency, patch-now scenario. Standard patch testing cycles should be bypassed in favor of immediate deployment. Before patching, take a snapshot of the server for potential forensic analysis. After applying the update, verify the build number in the N-central console to confirm the patch was successful. This update is the only effective remediation for the vulnerability itself and supersedes all previous hotfixes released in the past several weeks.
As a critical compensating control, organizations must ensure their N-able N-central management interface is not exposed to the public internet. Implement strict firewall rules to restrict all access to the server's web ports (e.g., TCP 80, 443) to a limited set of trusted IP addresses, such as internal administrative subnets or a corporate VPN range. This single measure would prevent external, unauthenticated attackers from reaching the vulnerable endpoint, effectively mitigating the risk of exploitation for CVE-2026-86218. If remote access is required for administrators, it must be fronted by a secure VPN with multi-factor authentication. This principle of 'deny by default' is fundamental to securing any management platform.
In response to this threat, and specifically the related authentication bypass flaws, it is crucial to implement continuous monitoring of accounts within the N-central application. Security teams should configure alerts for any creation of new user accounts, especially those with administrative privileges. The N-central audit log should be ingested into a SIEM for automated analysis. Create a rule that triggers a high-priority alert whenever a new administrative account is created and check it against a list of authorized personnel. This allows for rapid detection of an attacker creating a persistence mechanism after exploiting a flaw like CVE-2026-86207. This detective control is vital for identifying a breach if preventative measures fail.
Timeline of Events
Huntress begins investigating a compromise at a customer with a fully patched N-able N-central instance.
N-able releases Hotfix 3 to address an authentication bypass (CVE-2026-86207) and access control flaw (CVE-2026-86206).
N-able releases Hotfix 4 to address a new, critical RCE zero-day (CVE-2026-86218) and confirms it is being exploited in the wild.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.