Back-to-back N-able bugs send admins on a patching spree
CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-able N-central, is being exploited in the wild; Hotfix 4 mitigates it immediately.
N-able disclosed CVE-2026-86218 on September 6, a pre-authentication remote code execution flaw with CVSS 10.0 in its N-central RMM platform, and both N-able and Huntress report it is being exploited in the wild. It follows Huntress's disclosure of an exploit chain combining CVE-2026-86206 and CVE-2026-86207 that bypasses access controls to create unauthorized administrative accounts, investigated after a September 4 compromise of a fully patched customer environment. N-able has applied mitigations to all hosted N-central instances; on-premises customers must upgrade to Hotfix 4 (build 2026.3.1.14) immediately.
- CVE-2026-86218: unauthenticated RCE with CVSS 10.0, observed exploited in the wild
- Huntress documented a CVE-2026-86206/86207 chain creating unauthorized admin accounts
- Attackers manipulated account names with '.invalid' strings and probed remote control endpoints
- Huntress recommends IP allowlisting or VPN for the N-central console and auditing account creation
- Earlier August exploitation used 'Take Control' sessions via CVE-2026-18556 and CVE-2026-18577
- Products
- N-central
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-18556 | Authentication Bypass (Alternate Path/Channel) in N-able N-central | 8.2 | 8% | KEV | KEV |
| CVE-2026-18577 | Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch) | 8.2 | 15% | KEV | KEV |
CVE-2026-86207+1 related CVE | Authentication bypass in N-able N-central internal APIs before 2026.3 HF 3 | 7.7 group max | <1% | ||
| CVE-2026-86218 | Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild) | 10.0 | 15% | KEVPoC ×3 | KEV |
From the original article
3 min read at csoonline.com
A max-severity zero-day bug could be affecting cybersecurity firm N-able’s N-central remote monitoring and management platform, the company said, even as administrators were applying a hotfix for two vulnerabilities disclosed just a day earlier. The latest flaw, tracked as CVE-2026-86218, is a remote code execution bug that can give an attacker access to an N-central server without authentication.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.