CVE-2026-86218
Description
CVE-2026-86218 is a critical pre-auth RCE in N-able N-central (CVSS 9.8) actively exploited in the wild. Update to version 2026.3.1.14 immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| n-central | * | 2026.3 | vulnerable |
| n-central | 2026.3 | 2026.3 | vulnerable |
| n-central | 2026.3 | 2026.3 | vulnerable |
| n-central | 2026.3 | 2026.3 | vulnerable |
| n-central | 2026.3 | 2026.3 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately download and install the N-central 2026.3 Hotfix 4 or the latest available security update from the N-able Me portal to resolve the RCE flaw.
Update affected systems
Verify that all N-central instances are running version 2026.3.1.14 or higher; all versions prior to this release are considered vulnerable and must be upgraded.
Restrict access
Implement strict IP address allowlisting for the N-central management interface and ensure the server is protected by a web application firewall (WAF) to block suspicious network traffic.
Monitor for exploitation
Conduct a forensic review of system logs for unauthorized process executions, such as web server shells, and audit for any new administrative accounts created without authorization.
Detection Guidance
"To detect potential exploitation of CVE-2026-86218, monitor web server access logs for unusual inbound requests to unauthenticated endpoints, particularly those involving large payloads or suspicious characters. Look for indicators of compromise (IOCs) such as unexpected child processes (e.g., /bin/sh or cmd.exe) being spawned by the N-central service. Additionally, use network security monitoring to identify unauthorized outbound connections from the N-central server to unknown external IP addresses."