N-able Patches Pre-Authentication RCE in N-central

N-able released N-central 2026.3 Hotfix 4 to remediate CVE-2026-86218, a maximum-severity pre-authentication remote-code-execution vulnerability in its on-premises N-central remote monitoring and management platform. An unauthenticated attacker can exploit internet-exposed, unpatched instances with low complexity to execute malicious code; deployments on Hotfix 3 remain vulnerable, and N-able urged immediate installation of Hotfix 4.

N-able had not confirmed exploitation in production at the time of reporting, but Huntress identified a compromised customer environment and could not determine whether CVE-2026-86218 or separately patched high-severity flaws CVE-2026-86206 and CVE-2026-86207 caused the intrusion because relevant logs had rotated. Shadowserver identified nearly 1,500 internet-exposed N-central servers, concentrated in the United States and Europe, leaving a substantial potential attack surface.