CVE-2026-86218
published 2026-09-06CVE-2026-86218: N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
PriorityP194critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-09-11
Exploited in the wild
EPSS
13.35%
96.4th percentile
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| n-able | n-central | < 2026.3.1.14 | 2026.3.1.14 |
| n-able | n-central | < 2026.3 | 2026.3 |
| n-able | n-central | — | — |
| n-able | n-central | — | — |
| n-able | n-central | — | — |
| n-able | n-central | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.010.0CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck10.0CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
N-able N-central up to 2026.3.1.13 privileges management (EUVD-2026-72041)
vuldb·2026-09-08·CVSS 9.8
CVE-2026-86218 [CRITICAL] N-able N-central up to 2026.3.1.13 privileges management (EUVD-2026-72041)
A vulnerability was found in N-able N-central up to 2026.3.1.13 and classified as critical. This affects an unknown part. Such manipulation leads to improper privilege management.
This vulnerability is listed as CVE-2026-86218. The attack may be performed from remote. In addition, an exploit is available.
It is suggested to upgrade the affected component.
GHSA
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
ghsa_unreviewed·2026-09-06
CVE-2026-86218 [CRITICAL] CWE-96 N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
VulnCheck
N-able N-central Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
vulncheck·2026·CVSS 10.0
CVE-2026-86218 [CRITICAL] N-able N-central Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
N-able N-central Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
Affected: N-able N-central
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://uptime.n-able.com/event/201814/
CISA
N-able N-central Static Code Injection Vulnerability
cisa·2026-09-08·CVSS 9.8
CVE-2026-86218 [CRITICAL] CWE-96 N-able N-central Static Code Injection Vulnerability
Vulnerability: N-able N-central Static Code Injection Vulnerability
Affected: N-able N-central
N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4
No detection rules found.
Metasploit
N-able N-central Struts BeanUtils Unauthenticated RCE
metasploit
CVE-2026-86218 N-able N-central Struts BeanUtils Unauthenticated RCE
N-able N-central Struts BeanUtils Unauthenticated RCE
N-able N-central before 2026.3.1.14 uses a session-scoped Struts form on an unauthenticated action. Two concurrent multipart requests can race the form's multipart handler and expose Jetty's live configuration to Commons BeanUtils property population. This module changes a lazy N-central servlet holder into Jetty's bundled CGI servlet, configures it to invoke /bin/sh, and sends a command payload through the holder's existing URL mapping. By default, a second CGI request uses N-central's local JMX service and installed Java libraries to stop only the changed holder and restore its original servlet in memory.
Nuclei
N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution
nuclei·CVSS 9.8
CVE-2026-86218 [CRITICAL] N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution
N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution
N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication remote code execution via static code injection (CWE-96). An unauthenticated attacker with network access to the N-central management interface can execute arbitrary code on the server, potentially compromising every managed endpoint under the platform's control. Huntress confirmed active in-the-wild exploitation. N-able's hosted (NCOD) instances were automatically patched, on-premises deployments require manual upgrade to 2026.3.1.14. The N-central build version is exposed pre-authentication in the login page JavaScript object (ncentralVersion), enabling reliable version-based detection.
Template:
id: CVE-2026-86218
info:
name: N-ab
Recorded Future
September 2026 CVE Landscape
blogs_recorded_future·2026-10-13·CVSS 9.8
CVE-2026-88771 [CRITICAL] September 2026 CVE Landscape
## September 2026 CVE Landscape
In September 2026, Insikt Group® identified 94 high-impact vulnerabilities to prioritize for remediation , 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month. 43 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 37 were reported in open sources and validated by Insikt Group, and 14 were exclusively surfaced through honeypot data.
The 94 vulnerabilities identified affected products from 58 vendors, with Linux and Microsoft together accounting for approximately 13% of the vulnerabilities. The remaining exposures spanned network edge and security management appliances; operating systems (OS) and m
Rapid7
Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules
blogs_rapid7·2026-10-09·CVSS 6.4
CVE-2026-22778 [MEDIUM] Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules
I’m not sure how else to describe this release’s module content. Four modules targeting LLMs, two Linux LPE’s, 12 Windows AARCH64 fetch payloads, a TV streaming RCE, and a scanner targeting a CVE from 26 years ago? It is a privilege to work with committers and contributors with such varied passions, and who knows, next release we might have a Novell Netware module and then we really will party like it’s 1999!
## New module content (12)
## vLLM Multimodal Heap-Address Information Leak Scanner
Author: Kenneth LaCroix
Type: Auxiliary
Pull request: #21592 contributed by kenlacroix
scanner/http/vllm_multimodal_info_leak
CVE reference: CVE-2026-22778
Description: This adds an auxiliary scanner module vllm_multimodal_info_leak that detects vLLM OpenAI-compatible servers affected by CVE-20
Hackernews
N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
blogs_hackernews·2026-09-09·CVSS 6.9
CVE-2026-86218 [MEDIUM] N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 11, 2026.
The vulnerability in question is CVE-2026-86218 (CVSS score: 10.0), which has been described as a case of static code injection. It has been patched in N-central 2026.3 Hotfix 4 , released on September 5, 2026.
"N-able N-central contains a static code injection vulnerabilit
Hackernews
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
blogs_hackernews·2026-09-07·CVSS 6.9
CVE-2026-86206 [MEDIUM] ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on.
Elsewhere, a trusted software source delivered code that stole credentials, and a protocol designed for secure network management gave outsiders useful clues before login. Add active attacks on browsers, routers, and online stores, and there’s plenty to check—even for teams that have k
Hackernews
N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
blogs_hackernews·2026-09-07·CVSS 10.0
CVE-2026-86218 [CRITICAL] N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed.
N-able has released its fourth hotfix in five weeks for the N-central remote monitoring and management (RMM) platform, this time for a maximum-severity vulnerability that could allow remote code execution on the N-central server without authentication.
The company's own communications disagree on whether the fl
2026-09-06
Published
2026-09-08
Added to CISA KEV
Exploited in the wild