CVE-2026-86218: N-able N-central Perfect-Score Zero-Day RCE Exploited, MSP Supply-Chain Risk Elevated
N-able emergency-patched N-central CVSS 10.0 pre-auth RCE zero-day CVE-2026-86218. Huntress reports a fully patched production environment still compromised; ~1,500 servers exposed on the public internet.
On 5 Sep, N-able shipped an emergency hotfix for CVE-2026-86218 in its remote monitoring and management (RMM) platform N-central—a CVSS 10.0 pre-authentication remote code execution vulnerability. Multiple security vendors report suspected in-the-wild exploitation. Shadowserver telemetry shows ~1,500 N-central servers still exposed on the public internet, putting downstream endpoints hosted by MSPs under supply-chain risk.
Overview
N-able N-central is an RMM platform widely used by managed service providers (MSPs) to centrally manage endpoints across hundreds or thousands of downstream enterprises. On 5 Sep, N-able released N-central 2026.3 Hotfix 4, upgrading to 2026.3.1.14 and fixing CVE-2026-86218. The same weekend it also patched two high-severity authentication-bypass flaws, CVE-2026-86206 and CVE-2026-86207, which let attackers bypass authentication and obtain unrestricted access to the N-central platform.
Note: this is N-central's fourth emergency hotfix in five weeks. The emergency-patch cadence is clearly abnormal.
Technical details
CVE-2026-86218 is described by the vendor as a critical vulnerability that enables pre-authentication remote code execution on the N-central server—an attacker needs no valid credentials to run arbitrary code on the server. It was responsibly reported by a third party via N-able's security disclosure program.
A key contradiction: N-able's public advisory said there is currently no confirmation of production exploitation, while an expedited notice sent directly to customers stated the vulnerability has been observed exploited in the wild and classified it as a zero-day. Huntress separately reported that on 4 Sep a fully patched N-central production environment was compromised. Local server logs had already rotated, so it is unknown which of the three CVEs was used, and an undisclosed attack vector cannot be ruled out.
Impact
- Scores: CVE-2026-86218 CVSS 10.0 (Critical); CVE-2026-86206/86207 high-severity auth bypass.
- Scope: all on-prem deployments below 2026.3.1.14 (including environments already on Hotfix 3); hosted and on-prem both affected, covering Americas, APAC, and Europe.
- Exposure: Shadowserver tracked nearly 1,500 internet-exposed N-central servers, mainly in the U.S. and Europe.
- Cascade risk: an RMM platform is a high-leverage single point—once compromised, attackers can ride its management channel into every downstream endpoint an MSP hosts. A Kaseya-style supply-chain cascade is not hyperbole.
Remediation
- Immediately upgrade on-prem deployments to N-central 2026.3 HF4 (2026.3.1.14). Do not wait for a routine maintenance window.
- Per N-able guidance, audit N-central user accounts for unexpected new admins.
- Restrict inbound device access to VPN or management VLAN only. Do not expose directly to the public internet.
- Forward N-central logs to a SIEM in real time—local log retention is limited and post-incident tracing is hard.
- Huntress recommendation: treat as compromised until intrusion can be excluded. Check anomalous auth events, newly created accounts, and suspicious script execution.
Sources
- Help Net Security: N-able patches critical N-central zero-day exploited in the wild
- Shield53: Critical N-able RCE and Chrome V8 Zero-Day Highlight a Brutal September Patch Week