CVE-2026-86218

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-86218

N-able · N-central · Added 2026-09-08 · Published 2026-09-06

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityN-able N-central Static Code Injection Vulnerability

VendorN-able

ProductN-central

Date added2026-09-08

Due date2026-09-11

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-96

Descriptions

KEV: N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.

NVD: N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-08 19:41 UTC

Searches4

Component defaultyes

Sources https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution
https://www.ionix.io/threat-center/cve-2026-86218/
https://www.securityweek.com/n-able-patches-critical-zero-day-in-n-central/
https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/
https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html
https://www.decryptiondigest.com/blog/n-central-cve-2026-86218-pre-auth-rce-msp

QC notes

warn component_extraction: Component 'N-central web application endpoint — static code injection (CWE-96) in server-side request processing allows attacker-supplied input to be injected into and later executed as server-side code' matches or contains product name 'N-central' — no specific component identified

Hunting hypothesis agent

Monitor N-central logs for connections from 23.234.64.0/18 targeting the management API, then audit user accounts for newly created admin accounts not provisioned by IT -- the pre-auth static code injection enables rogue persistence.

Research details

ComponentN-central web application endpoint — static code injection (CWE-96) in server-side request processing allows attacker-supplied input to be injected into and later executed as server-side code

PreconditionsTarget must run N-able N-central on-premises versions prior to 2026.3.1.14. The N-central web interface or API must be reachable over the network from the attacker's position (typically an internet-facing or management-network-accessible instance). No authentication, privileges, or user interaction are required — the vulnerability is fully pre-authentication. The attacker sends crafted input that is injected into static code (CWE-96) on the server, achieving arbitrary code execution. Hosted N-central (NCOD) environments were patched server-side; only on-premises deployments are at risk. This is the third zero-day in N-central in six weeks. agent

Public PoCno

Advisoryhttps://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution

Exploit notesExploitation complexity: LOW | CRITICAL severity (CVSS 4.0 score 10.0). N-able assigned CVSS 4.0 base score of 10.0 as the CVE Numbering Authority. Huntress flagged CVE-2026-86218 as a zero-day after observing scans originating from IP range 23.234.64.0/18 beginning September 4, 2026. No public PoC is available as of September 8, 2026. This is the third zero-day in N-central in six weeks, following CVE-2026-86206 and CVE-2026-86207 which could be chained for authentication bypass. Administrators should check for newly created user accounts they do not recognize and review logs for connections from the 23.234.64.0/18 range.

SummaryCVE-2026-86218 is a critical pre-authentication remote code execution vulnerability (CVSS 10.0) in N-able N-central, affecting all versions prior to 2026.3.1.14. The flaw is a static code injection vulnerability (CWE-96) that allows an unauthenticated remote attacker to execute arbitrary code on the N-central server with no user interaction required. Huntress discovered scanning activity from IP range 23.234.64.0/18 beginning September 4, 2026, and the vulnerability was exploited as a zero-day before N-able released hotfix 4 (2026.3.1.14) on September 5, 2026. This is the third zero-day in N-central in six weeks. On-premises deployments must apply HF4 immediately; hosted environments (NCOD) were patched server-side. Administrators should check for unrecognized user accounts and review logs for scanning from the 23.234.64.0/18 range.

Tia coverage

First reported2026-08-03

First exploit report2026-09-07

Exploit report → KEV1 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-2026-0908-cisa-adds-4-known-exploited-vulnerabilities-to-ca critical-n-able-n-central-flaw-enables-pre-auth-remote-code-exec n-able-didn-t-beat-around-the-bush-since-our-post-9-5-2026-08-11 n-able-n-central-critical-auth-bypass-cve-2026-18556-18577-activ n-able-security-advisory-av26-885 proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.