CVE-2026-86218 | N-able N-central Pre-Authentication Remote Code Execution Vulnerability
N-able N-central pre-auth RCE CVE-2026-86218 (CVSS 10.0) is actively exploited; CISA added it to KEV and a hotfix is available.
CVE-2026-86218 is a critical pre-authentication remote code execution flaw (CWE-96 static code injection) in N-able N-central servers, scored 10.0 CVSS 4.0 by N-able and 9.8 CVSS 3.1 by NIST. N-able fixed it in N-central 2026.3 Hotfix 4 (build 2026.3.1.14) on September 5, 2026, and has already patched hosted NCOD environments. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 8, 2026, citing evidence of active exploitation, though researchers have not attributed every reported N-central compromise to this flaw. Horizon3 released a NodeZero Rapid Response test to validate exposure and recommends log review for prior compromise.
- Unauthenticated network attackers can execute code on N-central servers without user interaction
- Fixed in N-central 2026.3.1.14; on-premises deployments should upgrade immediately
- CISA KEV addition on September 8, 2026 confirms active exploitation
- Hosted NCOD instances already patched by N-able
- Restrict console access and audit N-central logs for prior compromise
- CVEs
- CVE-2026-86218
- Vendors
- N-ableHorizon3.ai
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86218 | Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild) | 10.0 | 15% | KEVPoC ×3 | KEV |
From the original article
2 min read at horizon3.ai
CVE-2026-86218 is a critical, actively exploited N-able N-central vulnerability that can allow unauthenticated remote code execution. NodeZero® Rapid Response safely validates exposure.
By Horizon3 · horizon3.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.