Critical Zero-Day Patch Released by N-able for N-central

Post Views: 20

IT software company N-able has released an emergency patch for a critical remote code execution (RCE) vulnerability in its N-central endpoint management system.

CVE-2026-86218 Vulnerability Details

The flaw, tracked as CVE-2026-86218, was identified following the resolution of two other vulnerabilities, CVE-2026-86206 and CVE-2026-86207. The vulnerability allows pre-authenticated access to the N-central server if exploited, according to the company’s warning. The flaw, assigned a CVSS score of 10/10, was discovered after N-able addressed the two previously disclosed issues.

Impact and Affected Systems

The company emphasized that users of hosted N-central environments do not need to take action, as the necessary updates were deployed server-side. However, administrators managing on-premises instances are required to apply the 2026.3 HF4 hotfix immediately.

Recommended Actions

N-able also advised users to review system logs for signs of unauthorized activity, specifically scanning attempts originating from the IP range 23.234.64.0/18. The company noted that this IP range has been linked to exploitation efforts targeting the vulnerability. Additionally, administrators should verify their deployments for any unexplained user account creations.

Exploitation Risks and Mitigation

While no confirmed exploitation of the vulnerability in production environments has been reported, N-able highlighted that unpatched systems remain at risk. The hotfix for CVE-2026-86218 supersedes the earlier patches for CVE-2026-86206 and CVE-2026-86207, which cybersecurity firm Huntress had previously flagged as potentially being used in combination to bypass authentication mechanisms and compromise N-central environments.

Huntress Report and Attack Observations

Huntress reported observing attacks on N-central’s underlying API and appliance logs starting September 4, 2026. However, the firm noted that limited historical logging on the appliance makes it difficult to determine the exact exploit method used by threat actors. Huntress also cautioned that alternative vulnerabilities could have been leveraged for compromise.

The company reiterated that the vulnerability’s exploitation could enable unauthorized access to critical infrastructure, underscoring the urgency of applying the hotfix.