N-able N-central CVSS 10.0 RCE (CVE-2026-86218)
N-able N-central Hit by Actively Exploited CVSS 10.0 RCE Flaw
Related Entities(initial)
Organizations
Products & Tech
CVE Identifiers
Full Report(when first published)
Executive Summary
N-able has issued an urgent security advisory for a critical vulnerability in its N-central remote monitoring and management (RMM) platform. The flaw, tracked as CVE-2026-86218, is a pre-authentication remote code execution (RCE) vulnerability with a CVSS score of 10.0, the maximum possible severity. The company has confirmed that this zero-day is being actively exploited in the wild. Successful exploitation allows an unauthenticated attacker to execute arbitrary code on a vulnerable N-central server, granting them complete control over the RMM platform and, by extension, privileged access to all downstream client endpoints managed by it. This represents a significant supply chain risk for Managed Service Providers (MSPs) and their customers. N-able has released Hotfix 4 (build 2026.3.1.14) to address the issue and is urging all on-premises customers to patch immediately.
Vulnerability Details
CVE-2026-86218 is a pre-authentication RCE vulnerability in the N-able N-central platform. Technical details of the flaw have not been publicly disclosed by N-able to prevent further exploitation. However, its classification as a pre-auth RCE with a CVSS 10.0 score indicates that an attacker requires no prior access or credentials and can exploit the flaw remotely over the network to gain full control of the server.
This incident is the culmination of a series of security failures for the product. On September 5, 2026, N-able patched two other flaws:
- CVE-2026-86206: An access control filter bypass.
- CVE-2026-86207: An authentication bypass.
Security firm Huntress had analyzed these earlier flaws and developed a PoC that chained them to create unauthorized administrative accounts. However, the system patched against these two vulnerabilities remained exposed to the more severe RCE flaw, CVE-2026-86218, necessitating the release of a fourth hotfix.
Affected Systems
- Product: N-able N-central
- Affected Versions: All on-premises builds prior to
2026.3.1.14. - Deployment: The vulnerability specifically impacts on-premises deployments. N-able's hosted cloud (NCOD) instances have been patched by the vendor.
Exploitation Status
N-able has directly confirmed to customers that CVE-2026-86218 is being actively exploited in the wild. This makes patching an urgent priority. The earlier vulnerabilities, CVE-2026-86206 and CVE-2026-86207, were also under investigation by security researchers, with Huntress demonstrating a working exploit chain before the patch for the RCE was released.
Impact Assessment
A compromise of an RMM platform like N-central is a worst-case scenario for an MSP. Attackers who gain control of the central management server can:
- Deploy malware, including ransomware, to every client managed by the MSP.
- Steal sensitive data from the MSP and its entire client base.
- Establish persistent access within dozens or hundreds of downstream networks.
- Use the MSP's trusted infrastructure to launch further supply chain attacks.
The impact is not limited to the MSP but extends to all of its customers, creating a massive blast radius from a single point of failure. This is the same attack pattern seen in the 2021 Kaseya VSA incident, which had widespread consequences.
Cyber Observables — Hunting Hints
Security teams managing N-able N-central servers should hunt for the following activity:
w3wp.execmd.exe, powershell.exe, or cscript.exe.Detection & Response
- Check for Unauthorized Accounts: Immediately audit all user accounts within the N-central platform, paying close attention to accounts with administrative privileges. Look for recently created accounts that are not associated with legitimate administrators.
- Analyze Web Logs: Review IIS logs on the N-central server for any suspicious access patterns around the dates of September 4-6, 2026, and onwards. Look for anomalous URI requests or requests from untrusted IP ranges.
- Monitor Process Activity: Use an EDR tool to monitor the N-central server for any suspicious process chains. The IIS worker process (
w3wp.exe) should not be spawning command shells or downloading external files. - Isolate and Investigate: If a compromise is suspected, immediately isolate the N-central server from the network to prevent further access to downstream clients. Preserve logs and system images for forensic analysis before rebuilding the server.
Mitigation
- Apply Hotfix 4 Immediately: The top priority is to update all on-premises N-able N-central instances to build
2026.3.1.14or later. This hotfix is cumulative and addresses CVE-2026-86218, CVE-2026-86206, and CVE-2026-86207. - Restrict Access: Do not expose the N-central management interface directly to the public internet. Access should be restricted to trusted IP addresses using a firewall or VPN. This is a critical mitigating control that would have prevented exploitation in many cases.
- Implement MFA: Enforce multi-factor authentication for all accounts accessing the N-central platform. While this may not have stopped the pre-authentication RCE, it is a critical defense against other attack vectors like the auth bypass flaw (CVE-2026-86207).
- Assume Compromise and Hunt: Given the active exploitation, organizations should assume they may have been compromised before patching and actively hunt for indicators of compromise as described in the Detection section.
Timeline of Events
Article Updates
September 8, 2026
Severity increasedNew details on N-able N-central RCE (CVE-2026-86218) include specific IP range for active exploitation and MITRE ATT&CK mapping.
Further analysis of the N-able N-central RCE (CVE-2026-86218) reveals that active exploitation was observed by Huntress labs targeting the platform's API as early as September 4, 2026. N-able has also identified scanning and exploitation activity originating from the IP range 23.234.64.0/18. This new information provides critical Indicators of Compromise (IOCs) for defenders to scan their logs and network traffic. Additionally, the report maps observed and inferred attacker techniques to MITRE ATT&CK, including T1190 (Exploit Public-Facing Application) for initial access and T1078.001 (Default Accounts) for persistence, offering a clearer picture of the attack methodology.
Update Sources:
Timeline of Events
Huntress begins investigating a compromise at a customer with a fully patched N-able N-central instance.
N-able releases Hotfix 3 to address an authentication bypass (CVE-2026-86207) and access control flaw (CVE-2026-86206).
N-able releases Hotfix 4 to address a new, critical RCE zero-day (CVE-2026-86218) and confirms it is being exploited in the wild.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.