Reported by 13 outlets

Timeline

1. original reporting

   Critical N-able N-central Flaw Enables Pre-Auth Remote Code Execution

   gbhackers.com · 36d ago · September 7th, 2026

   N-able has released a security update to address CVE-2026-86218, a critical-severity vulnerability in its N-central remote monitoring and management platform. This vulnerability could enable pre-authenticated remote code execution on an affected server. The issue is fixed in N-central version 2026.3 Hotfix 4, build 2026.3.1.14. Because an attacker may exploit this vulnerability before logging in, it […] The post Critical N-able N-central Flaw Enables Pre-Auth Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from bleepingcomputer.com

   N-able patches max severity N-central flaw amid ongoing attacks

   bleepingcomputer.com · 36d ago · September 7th, 2026

   IT departments and managed service providers (MSPs) use the N-central platform to monitor, manage, and maintain client networks and devices from a centralized web-based console. Tracked as CVE-2026-86218 , this RCE vulnerability allows threat actors without privileges to execute malicious code on unpatched N-central instances exposed online in low-complexity attacks. N-able addressed the flaw on Saturday by releasing N-central 2026.3 Hotfix 4 and urging customers to patch as soon as possible. "At this time, we have no confirmations that this vulnerability has been exploited in production environments, but unpatched systems remain at risk," the company said . "Customers running on-premises N-central deployments should upgrade to N-central 2026.3 HF4 immediately to protect their environment." Internet security nonprofit Shadowserver Foundation now tracks nearly 1,500 N-central servers exposed online , most of them located in the United States and Europe. Internet-exposed N-able N-central instances (Shadowserver) Evidence of active exploitation​ While N-able has yet to confirm that the CVE-2026-86218 flaw is being targeted, cybersecurity company Huntress has flagged it as a potential zero-day, along with two high-severity vulnerabilities (tracked as CVE-2026-86206 and CVE-2026-86207, and also patched over the wee

3. update from cyberpress.org

   Critical N-able N-central Flaw Enables Unauthenticated Pre-Auth Remote Code Execution

   cyberpress.org · 36d ago · September 7th, 2026

   N-central is used by managed service providers and IT teams to administer endpoints and customer environments from a central console. A pre-authentication remote code execution flaw is especially serious in that role: exploitation would not require valid N-central credentials, potentially giving an attacker a foothold on the management server that can span the administered infrastructure. Critical N-able N-central Flaw N-able has rated CVE-2026-86218 as critical, but has not published technical root-cause details, affected components, a CVSS numeric score, proof-of-concept code, or indicators of compromise. The bug was responsibly disclosed through the vendor’s security disclosure program. N-able said it has no confirmed evidence of exploitation in production environments as of the advisory’s publication; that statement should not be treated as evidence that exposed self-hosted servers are safe to defer patching. Direct upgrades to the new build are supported from versions 2025.4, 2026.1, 2026.2, 2026.3, and 2026.3.1 Hot

4. update from securityweek.com

   N-able Patches Critical Zero-Day in N-central

   securityweek.com · 35d ago · September 8th, 2026

   IT software firm N-able has rolled out an urgent fix for an unauthenticated remote code execution (RCE) vulnerability in its N-central endpoint management platform that has been exploited as a zero-day. While no action is required for N-central hosted environments, as the patches were deployed server-side, users of on-premises N-central instances should immediately apply the 2026.3 HF4 hotfix , the company says. “Review your logs for scanning activity. We’ve observed scans originating from the IP range 23.234.64.0/18 attempting to exploit this vulnerability. Check your logs for any connections from this range,” N-able also notes. Administrators are also advised to check their deployments for newly created user accounts they don’t recognize.

5. update from thehackernews.com

   🤖 CVE-2026-86218 (CVSS 10.0): pre-auth RCE in N-able N-central, actively exploited in the wild. CISA added it to the KEV catalog — FCEB agen

   thehackernews.com · 35d ago · September 9th, 2026

   CISA added it to the KEV catalog — FCEB agen

   via Mastodon https://thehackernews.com/2026/09/n-able-n-central-pre-auth-rce-flaw.html

6. update from theperimetersite.com

   CISA put CVE-2026-86218 on the Known Exploited Vulnerabilities list yesterday, September 8, and for those of you who don't spend your aftern

   theperimetersite.com · 34d ago · September 9th, 2026

   CISA put CVE-2026-86218 on the Known Exploited Vulnerabilities list yesterday, September 8, and for those of you who don't spend your aftern

   via Mastodon https://theperimetersite.com/report/242

7. mentioned by www.yazoul.net

   🔵 THREAT INTELLIGENCE N-able N-central Pre-Auth RCE Flaw Exploited in the Wild Vulnerability | CRITICAL CVEs: CVE-2026-86218 The U.S. Cybers

   www.yazoul.net · 34d ago · September 9th, 2026

8. mentioned by beyondmachines.net

   N-Able Patches N-Central Zero-Day Exploited in the Wild N-Able released an emergency hotfix for a remote code execution vulnerability (CVE-2

   beyondmachines.net · 33d ago · September 10th, 2026

9. update from meterpreter.org

   Discover the severe N-central CVE-2026-86218 vulnerability allowing unauthenticated RCE. Learn about N-able HF4 patches, CISA mandates, and

   meterpreter.org · 33d ago · September 10th, 2026

   Learn about N-able HF4 patches, CISA mandates, and

   via Mastodon https://meterpreter.org/n-central-cve-2026-86218-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

10. mentioned by cybersecurefox.com

    Critical N-able N-central RCE Flaw Exploited in the Wild 🔗 https:// cybersecurefox.com/en/n-able-n -central-critical-rce-cve-2026-86218 # n

    cybersecurefox.com · 32d ago · September 11th, 2026

11. mentioned by diesec.com

    N-able N-central: 4th emergency hotfix in 5 weeks. CVE-2026-86218 (CVSS 10.0) unauthenticated RCE. Huntress found an already-patched custome

    diesec.com · 32d ago · September 11th, 2026

12. mentioned by dashboard.shadowserver.org

    Still 218 instances of N-able N-central seen unpatched to CVE-2026-86218 pre-auth RCE that is exploited in the wild & on @CISACyber KEV. Top

    dashboard.shadowserver.org · 31d ago · September 12th, 2026

13. mentioned by securityonline.info

    CVE-2026-86218, a CVSS 10 N-central vulnerability, is exploited in the wild for remote code execution. A public Metasploit PoC is out. Patch

    securityonline.info · 30d ago · September 14th, 2026