Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-86218

Published 2026-09-06

Updated 2 months ago

Vendor/s

N-able

Product/s

N-central

Version/s

\* > 2026.3

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

9.8

/ 10

Critical

Severity Details

Base score

9.8 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-86218 is a critical pre-auth RCE in N-able N-central (CVSS 9.8) actively exploited in the wild. Update to version 2026.3.1.14 immediately.

## Why this matters

"This is a critical vulnerability with a CVSS score of 9.8 affecting N-able N-central, a prominent remote monitoring and management platform. Because it enables pre-authentication remote code execution (RCE), an attacker can gain full control over the server without any valid credentials. Its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog confirms that threat actors are actively leveraging this flaw. For service providers, a compromise of N-central is particularly dangerous as it could serve as a pivot point to attack numerous downstream client environments, necessitating immediate emergency patching."

## CPE

N-able

| Product   | Version Start | Version End (excl.) | Status     |
| --------- | ------------- | ------------------- | ---------- |
| n-central | \*            | 2026.3              | vulnerable |
| n-central | 2026.3        | 2026.3              | vulnerable |
| n-central | 2026.3        | 2026.3              | vulnerable |
| n-central | 2026.3        | 2026.3              | vulnerable |
| n-central | 2026.3        | 2026.3              | vulnerable |

## Related weakness (CWE)

CWE-96

## Remediation plan

1

### Apply official patches

Immediately download and install the N-central 2026.3 Hotfix 4 or the latest available security update from the N-able Me portal to resolve the RCE flaw.

2

### Update affected systems

Verify that all N-central instances are running version 2026.3.1.14 or higher; all versions prior to this release are considered vulnerable and must be upgraded.

3

### Restrict access

Implement strict IP address allowlisting for the N-central management interface and ensure the server is protected by a web application firewall (WAF) to block suspicious network traffic.

4

### Monitor for exploitation

Conduct a forensic review of system logs for unauthorized process executions, such as web server shells, and audit for any new administrative accounts created without authorization.

## Detection Guidance

"To detect potential exploitation of CVE-2026-86218, monitor web server access logs for unusual inbound requests to unauthenticated endpoints, particularly those involving large payloads or suspicious characters. Look for indicators of compromise (IOCs) such as unexpected child processes (e.g., /bin/sh or cmd.exe) being spawned by the N-central service. Additionally, use network security monitoring to identify unauthorized outbound connections from the N-central server to unknown external IP addresses."

## References

[https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution Vendor Advisory ](https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-86218 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)