N-able Releases Hotfix for Critical Remote Code Execution Vulnerability
N-able shipped Hotfix 4 patching CVE-2026-86218, a CVSS 10.0 pre-authentication RCE in N-central, with no confirmed production exploitation yet.
CVE-2026-86218 is a critical pre-authentication remote code execution flaw in N-able's N-central remote monitoring and management platform, disclosed September 6 with a maximum CVSS score of 10. It affects N-central versions before 2026.3.1.14 and is patched in N-central 2026.3 Hotfix 4. N-able says it has found no evidence of exploitation in production environments. It is the fifth N-able vulnerability disclosed in weeks, following two KEV-listed authentication bypasses and two internal API bypasses.
- CVE-2026-86218 allows unauthenticated code execution on N-central servers; affected component undisclosed
- Patch available in N-central 2026.3 Hotfix 4 (build 2026.3.1.14)
- CVE-2026-18556 and CVE-2026-18577 were added to CISA KEV in August after exploitation
- CVE-2026-86206 and CVE-2026-86207, internal API bypasses, were patched in Hotfix 3 on September 5
- Products
- N-central
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-18556 | Authentication Bypass (Alternate Path/Channel) in N-able N-central | 8.2 | 8% | KEV | KEV |
| CVE-2026-18577 | Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch) | 8.2 | 15% | KEV | KEV |
CVE-2026-86207+1 related CVE | Authentication bypass in N-able N-central internal APIs before 2026.3 HF 3 | 7.7 group max | <1% | ||
| CVE-2026-86218 | Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild) | 10.0 | 15% | KEVPoC ×3 | KEV |
From the original article
1 min read at infosecurity-magazine.com
The vulnerability, CVE-2026-86218, was allocated a maximum-severity rating by the software provider itself
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.