Volt Typhoon used rotating Silent Train relays for zero-days
Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.
86
Vendor
N-able
- Mentions · 7d5
- Mentions · 30d7
- All mentions27
- First seenAug 12, 2026
- Last mentioned1d ago
Timeline
27 articles · newest firstVolt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
84
Volt Typhoon Exploits Zero-Days to Breach Critical Infrastructure
Volt Typhoon built Silent Train framework using zero-days in Quest KACE, N-central, Cisco SD-WAN and VeloCloud to access U.S. critical infrastructure.
80
Volt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
84
Volt Typhoon uses Silent Train relays for zero-day edge attacks
Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.
86
Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules
Rapid7's Metasploit wrap-up adds 12 modules, including unauthenticated RCE for N-central, Langflow, LiteLLM, and dizqueTV.
52
How to secure RMM software: 8 controls MSPs should test
An Acronis-backed checklist tells MSPs to test eight RMM controls, citing N-able and SharePoint flaws.
28
CVE-2026-86218 | N-able N-central Pre-Authentication Remote Code Execution Vulnerability
N-able N-central pre-auth RCE CVE-2026-86218 (CVSS 10.0) is actively exploited; CISA added it to KEV and a hotfix is available.
85
12 Best Patch Management Software Compared (2026): Features & Pricing
GBHackers ranks NinjaOne, ManageEngine, and Automox atop twelve patch management tools for 2026, emphasizing third-party application coverage.
12
U.S. CISA adds Microsoft Windows, N-able N-central, and Adobe flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited flaws to its KEV catalog: Magento StyleSmuggler RCE, two Windows privilege-escalation bugs, and N-able N-central RCE.
80
CISA Warns of N-able N-central RCE Vulnerability Exploited in the Wild
CISA added CVE-2026-86218, a CVSS 10.0 unauthenticated RCE in N-able N-central RMM, to its KEV catalog; on-premises admins must patch to 2026.3.1.14.
84
N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
CISA added CVE-2026-86218 (CVSS 10.0), a pre-auth RCE in N-able N-central, to KEV after N-able confirmed in-the-wild exploitation; patch by September 11.
84
N-able security advisory (AV26-885)
N-able says CVE-2026-86218 in N-central is exploited in the wild; MSPs must apply hotfix 2026.3.1.14 (2026.3 HF4).
66
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited vulnerabilities to its KEV catalog, covering Adobe Commerce/Magento, Microsoft Windows, and N-able N-central.
72
CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.
62
N-able Patches Critical Zero-Day in N-central
N-able patches critical unauthenticated RCE zero-day CVE-2026-86218 in N-central, exploited in the wild; on-premises admins must apply hotfix 2026.3 HF4.
78
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.
72
N-able Releases Hotfix for Critical Remote Code Execution Vulnerability
N-able shipped Hotfix 4 patching CVE-2026-86218, a CVSS 10.0 pre-authentication RCE in N-central, with no confirmed production exploitation yet.
72
Back-to-back N-able bugs send admins on a patching spree
CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-able N-central, is being exploited in the wild; Hotfix 4 mitigates it immediately.
88
N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
N-able shipped Hotfix 4 for a CVSS 10.0 unauthenticated RCE (CVE-2026-86218) in N-central RMM, with conflicting statements on exploitation.
76
N-able N-central HF4 Fixes Critical RCE After Series of Authentication Flaws
N-able released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) fixing CVE-2026-86218, a critical pre-authentication RCE.
58
N-able patches max severity N-central flaw amid ongoing attacks
N-able ships an emergency hotfix for a maximum-severity RCE flaw in its N-central RMM platform that attackers are actively exploiting.
82
N-able patches critical N-central zero-day exploited in the wild (CVE-2026-86218)
N-able shipped an emergency hotfix for CVE-2026-86218, a pre-auth RCE zero-day in N-central RMM observed exploited in the wild.
84
Critical N-able N-central Vulnerability and Active Exploitation
N-able N-central pre-auth RCE zero-day CVE-2026-86218 (CVSS 10.0) is exploited in the wild; on-prem admins must upgrade to 2026.3 HF4.
83
Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day
Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.
32
Storm-1175 Replaces Medusa With New StormEncryptor Ransomware
Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.
62
N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577
N-able shipped a second N-central hotfix as attackers actively exploit authentication bypass CVE-2026-18577, attributed to ransomware group Storm-1175.
78
Related CVEs
by mentions- CVE-2026-8621815%10.0Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild)
- CVE-2026-86207<1%7.7Authentication bypass in N-able N-central internal APIs before 2026.3 HF 3
- CVE-2026-86206<1%6.9Access Control Filter Bypass in N-able N-central Exposes Internal APIs
- CVE-2026-1857715%8.2Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch)
- CVE-2025-88764%9.4OS Command Injection in N-able N-central Before 2025.3.1
- CVE-2025-88753%9.4Insecure Deserialization Code Execution in N-able N-central (KEV)
- CVE-2026-168122%10.0OS Command Injection in Arista VeloCloud Orchestrator On-Prem
- CVE-2026-2012789%10.0Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
- CVE-2026-185568%8.2Authentication Bypass (Alternate Path/Channel) in N-able N-central
- CVE-2024-397174%7.2Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon
Appears with
- N-centralproduct · 22
- CISAorganization · 9
- Microsoftvendor · 7
- Ciscovendor · 6
- Huntressorganization · 6
- N-ableorganization · 6
- Black Lotus Labsorganization · 5
- VeloCloud Orchestratorproduct · 5
- Volt Typhoonthreat actor · 5
- Versa Directorproduct · 4
- Questvendor · 4
- Huntressvendor · 4
- Versavendor · 4
- CISAvendor · 4
- KACEproduct · 3
- Adobe Commerceproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.