N-able security advisory (AV26-885)
N-able says CVE-2026-86218 in N-central is exploited in the wild; MSPs must apply hotfix 2026.3.1.14 (2026.3 HF4).
Canadian Centre for Cyber Security advisory AV26-885 covers CVE-2026-86218 in N-able N-central, which the vendor confirms is being exploited in the wild. Versions prior to 2026.3.1.14 are affected, and the fix ships as N-central 2026.3 Hotfix 4. The Cyber Centre urges users and administrators to apply the update promptly.
- CVE-2026-86218 in N-able N-central confirmed exploited in the wild by the vendor
- Affected: N-central versions prior to 2026.3.1.14; fix is 2026.3 Hotfix 4
- CCC advisory AV26-885 urges immediate application of the hotfix
- CVEs
- CVE-2026-86218
- Vendors
- N-able
- Products
- N-central
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86218 | Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild) | 10.0 | 15% | KEVPoC ×3 | KEV |
From the original article
1 min read at cyber.gc.ca
Serial Number: AV26-885 Date: September 8, 2026 As of September 6, 2026, N-able is affected by vulnerabilities in the following product: N-central Prior to 2026. 3. 1.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.