N-able patches critical N-central zero-day exploited in the wild (CVE-2026-86218)
N-able shipped an emergency hotfix for CVE-2026-86218, a pre-auth RCE zero-day in N-central RMM observed exploited in the wild.
N-able released Hotfix 4 for N-central 2026.3 on September 5 (build 2026.3.1.14), fixing CVE-2026-86218, a critical pre-authenticated remote code execution flaw in its RMM platform popular with MSPs. A private customer notice marked urgent said the zero-day 'has been observed being exploited in the wild,' while the public advisory said there were no confirmed production exploits. Huntress also flagged two high-severity vulnerabilities, CVE-2026-86206 and CVE-2026-86207, which allow authentication bypass and unrestricted access; they were patched the same weekend and were discovered by Rapid7's Stephen Fewer. N-able advised auditing N-central user accounts for unexpected users.
- CVE-2026-86218: critical pre-auth RCE in N-central; hotfix 2026.3.1.14 released September 5
- Private notice says exploited in the wild; public advisory claims no confirmed production exploitation
- Both hosted and on-prem N-central deployments affected across Americas, APAC, and Europe
- Auth bypass flaws CVE-2026-86206 and CVE-2026-86207 found by Rapid7, patched same weekend
- Huntress customer saw a compromised patched N-central server; logs had already rotated
- Products
- N-central
- Organizations
- Stephen Fewer
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-86207+1 related CVE | Authentication bypass in N-able N-central internal APIs before 2026.3 HF 3 | 7.7 group max | <1% | ||
| CVE-2026-86218 | Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild) | 10.0 | 15% | KEVPoC ×3 | KEV |
From the original article
2 min read at helpnetsecurity.com
N-able released an emergency hotfix for CVE-2026-86218, a remote code execution (RCE) flaw affecting N-central, its remote monitoring and management (RMM) solution popular with managed service providers (MSPs). In its release notes, N-able described CVE-2026-86218 as a “critical-CVSS-rated vulnerability that could allow for pre-authenticated remote code execution on the N-central server.”
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.