CISA put N-able's pre-auth N-central RCE on KEV three days after the hotfix shipped
CVE-2026-86218 lets an unauthenticated attacker run code on an N-central server with no user interaction. N-able fixed it in build 2026.3.1.14 and has already patched its own hosted instances.
The Watch · Security desk
What happened
- CVE-2026-86218 is a pre-authentication remote code execution flaw in N-able N-central that an unauthenticated attacker with network access to the server can exploit without any user interaction.
- N-able released the fix, N-central 2026.3 Hotfix 4, build 2026.3.1.14, on September 5, 2026, and the CVE itself was published the following day.
- Horizon3 released a NodeZero Rapid Response test on September 15 that runs real attack techniques to check whether remote code execution is possible in a customer environment.
Why it matters
- What it limits constraint The emergency change window belongs only to organizations running N-central themselves, because N-able has already patched its hosted NCOD environments and says those customers need to do nothing.
- Who has to decide decision Self-hosted operators who cannot install 2026.3.1.14 today are choosing between an outage and running a vulnerable console behind network restrictions that reduce reach without removing the bug.
- Who's exposed exposure Anyone upgrading now inherits an unexamined exposure window and has to work through N-central accounts, appliance logs and administrative activity before treating the server as clean.
- What doesn't add up contradiction CISA states the flaw is being exploited, yet published N-central intrusions also involve other recent vulnerabilities, so a compromised console cannot be booked to this CVE without its own evidence.
Next story · Security · Sep 30
Attackers reach admin on Cisco Catalyst SD-WAN Manager by encoding one URL characterConfirmed12 publishers
The CVE record classifies CVE-2026-86218 as CWE-96, improper neutralization of directives in statically saved code, also called static code injection [16]. The scoring inputs are low attack complexity and no privileges, and no user interaction is required [3][1]. N-able scored it 10.0 under CVSS 4.0. NIST scored it 9.8 under CVSS 3.1 [15]. CISA added it to the Known Exploited Vulnerabilities catalog on evidence of active exploitation [2][13].
Three days separate the hotfix from the KEV entry [19]. The CVE was published one day after the fix [11][12]. Any on-premises server still running a build earlier than 2026.3.1.14 is exposed to a flaw that CISA says is in use [5][2].
The upgrade is the remediation N-able lists for on-premises deployments, and its public release notes list no alternative [8]. Restricting console access from the public internet and other untrusted networks reduces risk and leaves the vulnerability in place [17].
Attribution is where the public record thins out. CISA has confirmed exploitation [2]. Public reporting on N-central intrusions also involves other recently disclosed vulnerabilities, and researchers have not conclusively attributed every observed compromise to CVE-2026-86218 [10]. A responder faces this both ways: an intrusion on an N-central console leaves the entry point an open question, and patching this CVE leaves open whether the console was already entered.
Horizon3's write-up says applying the hotfix does not determine whether a system was compromised beforehand, and directs operators to review N-central accounts, appliance logs, and administrative activity [9]. The write-up describes impact to the N-central server itself, covering confidentiality, integrity and availability of that system [4]; devices managed through the console fall outside it [14].
Horizon3 also sells the test it released ten days after the hotfix, a NodeZero Rapid Response check that runs real attack techniques to confirm whether remote code execution is possible in a given environment [18][21][20]. The exploitation finding is CISA's, not the vendor's [2].
What to watch
- Whether any researcher or CISA advisory attributes a specific N-central intrusion to CVE-2026-86218 rather than to the other recently disclosed flaws.
- Whether a public proof-of-concept or exploit code for the CWE-96 injection appears, which would widen the pool of attackers beyond whoever CISA saw.
- Whether N-able publishes indicators of compromise or a compromise-assessment procedure for servers patched after September 5.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+5
- Incentives70
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-86218 is a critical pre-authentication remote code execution vulnerability affecting N-able N-central; an unauthenticated attacker with network access to a vulnerable N-central server could exploit it to execute code without user interaction.
- [2]
CISA added CVE-2026-86218 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation, and has confirmed the vulnerability is being exploited.
- [3]
The vulnerability has low attack complexity and requires no privileges.
- [4]
Successful exploitation could allow an attacker to execute code on the N-central server, affecting the confidentiality, integrity, and availability of the system.
- [5]
N-able N-central versions before 2026.3.1.14 are affected.
- [6]
N-able addressed CVE-2026-86218 in N-central 2026.3 Hotfix 4, build 2026.3.1.14, and customers operating on-premises deployments should upgrade immediately.
- [7]
N-able has already applied the patch to hosted N-central environments, also referred to as NCOD, and customers using hosted instances do not need to take action.
- [8]
N-able directs customers with on-premises deployments to upgrade to version 2026.3.1.14, and the vendor has not identified an alternative remediation in its public release notes.
- [9]
Because exploitation has been reported, organizations should review N-central accounts, appliance logs, and administrative activity for signs of unauthorized access; applying the hotfix does not determine whether a system was compromised before it was patched.
- [10]
Public reporting about specific N-central intrusions also involves other recently disclosed vulnerabilities, and researchers have not conclusively attributed every observed compromise to CVE-2026-86218.
- [11]
On September 5, 2026, N-able released N-central 2026.3 Hotfix 4, build 2026.3.1.14, addressing CVE-2026-86218.
- [12]
CVE-2026-86218 was published on September 6, 2026.
- [13]
CISA added CVE-2026-86218 to its Known Exploited Vulnerabilities catalog on September 8, 2026.
- [14]
Horizon3's write-up scopes the described impact to the N-central server and does not describe consequences for devices managed through the N-central console.
- [15]
N-able assigned CVE-2026-86218 a CVSS 4.0 score of 10.0, while NIST assigned it a CVSS 3.1 score of 9.8.
- [16]
The official CVE record classifies CVE-2026-86218 as CWE-96, Improper Neutralization of Directives in Statically Saved Code, also known as static code injection.
- [17]
If an upgrade cannot be completed immediately, access to the N-central console should be restricted from the public internet and other untrusted networks; this is a risk-reduction measure and does not remediate the vulnerability.
- [18]
On September 15, 2026, Horizon3 released a NodeZero Rapid Response test for CVE-2026-86218 that executes real attack techniques without causing damage to validate whether the vulnerability can be exploited in a given environment.
- [19]
Three days separate N-able's hotfix release from CISA's KEV listing of CVE-2026-86218.
- [20]
The CVE-2026-86218 write-up was published by Horizon3.ai, which markets the NodeZero Proactive Security Platform and directs readers to launch the Rapid Response test from that platform.
- [21]
Ten days separate N-able's hotfix release from Horizon3's release of its NodeZero Rapid Response test.
Sources
2 independent publishers whose own reporting we read for this story.
- horizon3.aiCVE-2026-86218 | N-able N-central Pre-Authentication Remote Code Execution Vulnerability
1 article · September 16, 2026
- N-central Security Update – Take Action to Apply 2026.3 HF4 - N-able
n-able.com
1 article · September 18, 2026