CVE-2026-86218
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Sep 8, 2026
- US federal agencies must remediate it by Sep 11, 2026 (BOD 22-01)
- Attacked on the day of disclosure
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Sep 8, 2026 Sep 8, 2026 Sep 6, 2026 Sep 6, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| n-able | n-central | < 2026.3 |
Related articles
Fortinet CVE-2025-25249 Exploited at Scale to Install PivotC2 RAT
Attackers exploit Fortinet CVE-2025-25249 RCE flaw at scale, scanning 30,000+ IPs to install PivotC2 RAT on 178 devices for tunneling and data theft.
Actively Exploited N-able N-central Flaw Enables Pre-Authentication Remote Code Execution
CISA warns CVE-2026-86218 in N-able N-central is actively exploited, enabling pre-auth RCE. Update to 2026.3 Hotfix 4 immediately.
N-able Fixes Critical Pre-Auth RCE in N-central as Exploitation Reports Conflict
N-able fixes CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-central. Update to 2026.3.1.14 immediately amid conflicting exploitation reports.
This product uses the NVD API but is not endorsed or certified by the NVD.