N-able Releases Hotfix for Critical RCE Vulnerability in N-central Platform
N-able has issued a critical hotfix for its N-central platform to address CVE-2026-86218, a pre-authenticated remote code execution vulnerability that could allow attackers to compromise managed systems.
N-able has released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) to address CVE-2026-86218, a critical pre-authenticated remote code execution vulnerability. This flaw allows unauthenticated attackers to execute arbitrary commands on exposed N-central servers, posing a significant risk to the downstream systems managed by IT teams and managed service providers.
The hotfix is specifically for on-premises N-central deployments, and N-able strongly urges self-hosted customers to install it immediately. The company has not confirmed exploitation in the wild, but emphasizes that delaying the patch leaves systems vulnerable to potential attacks. The severity of the vulnerability stems from the platform's extensive access, which can include endpoints, networks, credentials, and administrative tools.
CVE-2026-86218 enables an attacker to execute commands on the N-central server without needing to log in or provide any credentials. Successful exploitation could grant attackers control over the central management server, opening the door to deploying malware, altering monitoring configurations, stealing sensitive data, creating unauthorized accounts, or pivoting further into customer environments.
While N-able has not publicly disclosed the exact technical details or attack vector for CVE-2026-86218, they confirmed that the vulnerability was responsibly reported by a third party. Despite the absence of confirmed exploitation, organizations are advised not to delay patching. Publicly disclosed vulnerabilities can often spur threat actors to develop and deploy exploits.
Customers running N-central versions 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1, or 2026.3.1 Hotfix 2 can upgrade directly to the latest hotfix, build 2026.3.1.14. Those on older releases should first upgrade to a supported version before applying the hotfix.
N-able confirmed that their hosted N-central customers (NCOD users) do not need to take any action, as the necessary patches have already been applied to their environments. The urgent call to action is directed solely at organizations managing their own self-hosted N-central infrastructure.
Additionally, N-able stated that N-central agents do not require specific updates to address CVE-2026-86218. However, they recommend keeping agents updated as a general security best practice. Security teams are advised to identify all self-hosted N-central instances, verify their current build number, and schedule the update to build 2026.3.1.14 as soon as possible.
As a precautionary measure, administrators should review server access logs, administrator account activity, remote command execution records, and any unusual configuration changes for signs of suspicious behavior, both before and after applying the patch.
N-able has issued a fourth hotfix, 2026.3.1.14, for its N-central RMM platform to address a critical unauthenticated remote code execution vulnerability, CVE-2026-86218. This new hotfix is necessary for all on-premises N-central builds prior to this version, including those updated to the previous hotfix. While N-able's incident notice suggests the flaw has been exploited in the wild, its release notes state this remains unconfirmed, creating a divergence in official communications.
While N-able's initial advisory downplayed exploitation, a separate urgent customer notice confirmed that CVE-2026-86218 has been observed being exploited in the wild, classifying it as a zero-day. This notice also indicated that both hosted and on-premises N-central deployments across the Americas, APAC, and Europe are impacted, a broader scope than initially suggested.
This update from Infosecurity Magazine confirms that N-able has released a hotfix for the critical remote code execution vulnerability, CVE-2026-86218. The software provider itself assigned the highest severity rating to this flaw, underscoring its potential impact on managed systems.
The newly released article provides additional context by detailing that CVE-2026-86218, a critical zero-day vulnerability in N-able's N-central platform, could allow pre-authenticated access to the server. It also highlights that the hotfix supersedes previous patches for CVE-2026-86206 and CVE-2026-86207, which Huntress had flagged as potentially chained for authentication bypass. Furthermore, N-able observed scans from the IP range 23.234.64.0/18 targeting this vulnerability.
This new report from Rapid7 Labs details two previously undisclosed vulnerabilities, CVE-2026-86206 and CVE-2026-86207, which can be chained to allow an unauthenticated remote attacker to bypass authentication and create a new administrator account. The previous article focused on CVE-2026-86218, a different critical RCE vulnerability, and this new information expands the known attack surface for N-able N-central.
CISA has officially added CVE-2026-86218 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies patch the critical pre-authentication RCE flaw by September 11, 2026. This designation comes as N-able confirmed the vulnerability is being actively exploited in the wild, urging immediate application of the N-central 2026.3 Hotfix 4.