N-able patches critical N-central zero-day exploited in the wild (CVE-2026-86218). N-able released an emergency hotfix for CVE-2026-86218, a remote code execution (RCE) flaw affecting N-central, its remote monitoring and management (RMM) solution popular with managed service providers (MSPs). In its release notes, N-able described CVE-2026-86218 as a "critical-CVSS-rated vulnerability that could allow for pre-authenticated remote code execution on the N-central server." N-able addressed the flaw on September 5 by releasing Hotfix 4 for N-central 2026.3, bringing the build to version 2026.3.1.14. "Customers running on-premises N-central deployments should upgrade to N-central 2026.3 HF4 immediately to protect their environment," the company added. "This vulnerability was responsibly disclosed by a third party through our security disclosure program. At this time, we have no confirmations that this vulnerability has been exploited in production environments, but unpatched systems remain at risk," the company noted. In a separate notice sent directly to customers, marked as urgent and calling for the hotfix to be applied immediately, N-able said CVE-2026-86218 "has been observed being exploited in the wild" and called it a zero-day, contradicting the claims in its public advisory. The notice listed both hosted and on-premises N-central deployments as impacted, spanning the Americas, APAC, and Europe. Cybersecurity firm Huntress also flagged CVE-2026-86218 as a potential zero-day, alongside two high-severity vulnerabilities, CVE-2026-86206 and CVE-2026-86207, which N-able patched over the weekend and which can allow attackers to bypass authentication and gain unrestricted access to the N-central platform. The firm says it learned of the flaw through a Discord post from an N-able employee in the MSPGeek community, ahead of N-able's own public hotfix announcement. "In our 9/5/26 update, we had said we could not rule out whether the two previous vulnerabilities released (CVE-2026-86206 and CVE-2026-86207) were the ones that were exploited in the instance seen in the patched production environment of one of our customers. Because logs on the compromised N-central server had already rotated, we are also unable to say whether this new CVE was the vulnerability exploited in that case," Huntress explained. "As a precaution, we recommend auditing your N-central user accounts to ensure that there are no unexpected users," N-able concluded. More about

N-able released hotfix for RCE vulnerability affecting platform. Spread the love N-able has released N-central 2026.3 Hotfix 4 to fix CVE-2026-86218. This critical vulnerability could allow an unauthenticated attacker to execute code remotely on an exposed N-central server. The update, identified as build 2026.3.1.14, was issued for on-premises N-central deployments. N-able urged self-hosted customers to install the hotfix immediately, warning that systems left unpatched remain at risk even though the company has not confirmed exploitation in production environments. CVE-2026-86218 is a pre-authenticated remote code execution vulnerability. This means an attacker may be able to trigger the flaw without first logging in or providing valid user credentials. If successfully exploited, the issue could allow an attacker to run commands on the N-central server. N-central is used by managed service providers and IT teams to monitor, manage, automate, and secure customer systems. Because the platform can have broad access across endpoints, networks, credentials, and administrative tools, a compromise of the central management server could create serious downstream risks. Attackers who gain control of an N-central server could potentially use that access to deploy malicious software, alter monitoring settings, steal stored information, create unauthorized accounts, or move further into managed customer environments. N-able released hotfix. The exact technical details and attack vector for CVE-2026-86218 have not been publicly disclosed. N-able said a third party responsibly reported the flaw through its security disclosure program. The vendor stated that it currently has no confirmation of active exploitation. However, organizations should not treat the lack of known attacks as a reason to delay patching. Public patch releases can help threat actors identify vulnerable systems and develop exploit attempts. The new release replaces N-central 2026.3 Hotfix 3, build 2026.3.1.13. Customers running versions 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1, or 2026.3.1 Hotfix 2 can upgrade directly to build 2026.3.1.14. Organizations using older releases should first move to a supported upgrade version and then apply the latest hotfix. N-able confirmed that hosted N-central customers, also known as NCOD users, do not need to take any action because the patches have already been applied to their environments. The urgent action applies to organizations operating their own self-hosted N-central infrastructure. The company also said administrators do not need to upgrade N-central agents specifically to address CVE-2026-86218. However, it recommended keeping agents up to date with the latest available version as a general security practice. Security teams should identify all self-hosted N-central instances, confirm their installed build number, and schedule the update to 2026.3.1.14 as soon as possible. Administrators should also review server access logs, administrator account activity, remote command execution records, and unusual configuration changes for signs of suspicious behavior before and after patching. Learn 7 Metric-Gated AI SOC Deployment Phases - Download Free AI SOC Deployment Playbook 2026. The post N-able released hotfix for RCE vulnerability affecting platform appeared first on cyber security News. August 3, 2026 N-able has disclosed a critical security vulnerability in its N-central remote monitoring and management (RMM) platform, which could allow unauthenticated attackers to gain full administrative, or "god-mode," access to the RMM console. This issue affects all currently supported N-central versions, including both cloud-hosted and on-premises deployments, and... August 3, 2026 In "Cybersecurity News - Original News Source is cybersecuritynews.com" August 4, 2026 CISA has warned that attackers are actively exploiting a critical authentication bypass vulnerability in N-able N-central. Tracked as CVE-2026-18577, the flaw affects N-central servers running versions earlier than 2026.3.1.7. N-central is a remote monitoring and management platform widely used by managed service providers to administer customer systems... August 4, 2026 In "Cybersecurity News - Original News Source is cybersecuritynews.com" N-able's N-central remote management and monitoring (RMM) platform faces critical security risks following the discovery of multiple vulnerabilities. According to Horizon3.ai, it allows unauthenticated attackers to bypass authentication, access legacy APIs, and exfiltrate sensitive files, including credentials and database backups. The Vulnerability Chain Earlier this year, N-able N-central was added... November 20, 2025 In "Cybersecurity News - Original News Source is cybersecuritynews.com"