Loading vulnerability…
Pre-authentication remote code execution in N-able N-central
CVE-2026-86218 is a static code injection vulnerability affecting N-able N-central versions earlier than 2026.3.1.14. Insufficient neutralization of externally supplied code directives allows an unauthenticated remote attacker to submit crafted HTTP or HTTPS requests that inject directives into statically saved code. Subsequent server processing executes those directives, enabling arbitrary code execution. A demonstrated Metasploit exploit against build 2026.3.1.13 uses a multipart race condition and the unauthenticated LogRetrieval CGI handler. The vulnerability has a CVSS v4.0 score of 10.0. CISA added it to the Known Exploited Vulnerabilities catalog on September 8, 2026, despite conflicting initial vendor statements about confirmed production exploitation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of the N-central server and can enable takeover of the remote monitoring and management platform. Its privileged access to managed systems creates potential downstream consequences, including sensitive information theft, unauthorized account and configuration changes, malicious script or software deployment, ransomware deployment, and lateral movement into customer environments. These downstream effects depend on the compromised server's permissions and connectivity. The demonstrated exploit executed as the N-central service account, not as a demonstrated root session.
If you can’t patch tonight, do this now.
Until patched, restrict N-central web and API access to trusted administrative networks or VPN users, block untrusted inbound access, and segment the management server from unnecessary network paths. Monitor server access, API activity, administrative account changes, remote-command execution, and downstream remote-control sessions for anomalies. Investigate systems exposed before patching for historical compromise. Administrative MFA does not prevent exploitation of this pre-authentication flaw and is not a substitute for the update. The demonstrated exploit leaves an unauthenticated CGI handler active until N-central is restarted; restarting removes that exploit-induced state but does not remediate the vulnerability or establish that the server is clean.
Patch, then assume compromise.
Immediately upgrade affected on-premises N-central servers to N-central 2026.3 Hotfix 4, build 2026.3.1.14, or a later fixed release. Hotfix 4 supersedes earlier hotfixes; Hotfix 3, build 2026.3.1.13, remains vulnerable. Older installations may require an intermediate supported release before applying the fix. Verify the running server's exact build after updating. Hosted N-central environments were patched by N-able and require no customer-installed server update. N-central agents do not require an upgrade specifically for this vulnerability. If compromise is suspected, investigate the server and managed endpoints, remove unauthorized access and persistence, and rotate affected administrator and service credentials; patching alone does not remove an existing intrusion.
1 exploit validated by Mallory's analysis. Hidden: 3 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
176 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.