N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
N-able shipped Hotfix 4 for a CVSS 10.0 unauthenticated RCE (CVE-2026-86218) in N-central RMM, with conflicting statements on exploitation.
N-able released 2026.3 Hotfix 4 (build 2026.3.1.14) fixing CVE-2026-86218, a static code injection weakness (CWE-96) scored 10.0 on CVSS 4.0 that enables pre-authentication remote code execution on on-premises N-central RMM servers. Hosted NCOD instances are already patched; N-able's incident notice says the flaw was observed exploited in the wild while its release notes say exploitation is unconfirmed. Huntress, which has tracked N-central attacks since August, advises IP allowlisting, VPN-only access, or taking internet-reachable servers offline until patching. It is the fourth hotfix in five weeks, following fixes for CVE-2026-86206 and CVE-2026-86207, which CISA added to its Known Exploited Vulnerabilities catalog.
- CVE-2026-86218: CVSS 10.0 pre-auth RCE via static code injection (CWE-96)
- All on-premises builds below 2026.3.1.14 affected; hosted instances already patched
- N-able's status page says exploited in the wild; release notes say unconfirmed
- Huntress advises IP allowlisting or taking internet-reachable servers offline
- Fourth hotfix in five weeks; earlier flaws CVE-2026-86206/86207 are on CISA KEV
- CVEs
- CVE-2026-86218CVE-2026-86206CVE-2026-86207CVE-2026-18577CVE-2026-18556CVE-2025-8875CVE-2025-8876
- Vendors
- N-able
- Products
- N-centralTake Control
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-8876+1 related CVE | OS Command Injection in N-able N-central Before 2025.3.1 | 9.4 | 4% | KEV | KEV |
| CVE-2026-18556 | Authentication Bypass (Alternate Path/Channel) in N-able N-central | 8.2 | 8% | KEV | KEV |
| CVE-2026-18577 | Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch) | 8.2 | 15% | KEV | KEV |
CVE-2026-86207+1 related CVE | Authentication bypass in N-able N-central internal APIs before 2026.3 HF 3 | 7.7 group max | <1% | ||
| CVE-2026-86218 | Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild) | 10.0 | 15% | KEVPoC ×3 | KEV |
From the original article
4 min read at thehackernews.com
Every on-premises N-central build below 2026. 3. 1.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.