N-able N-central CVE-2026-86218: 10.0 Unauth RCE

N-able N-central CVE-2026-86218 is a maximum-severity, CVSS 10.0 vulnerability that allows unauthenticated remote code execution on the N-central server, and it affects every on-premises build below 2026.3.1.14, including servers that had just been updated to Hotfix 3 a day earlier. N-able, acting as the CVE Numbering Authority, assigned the CVSS 4.0 score of 10.0 and classed the flaw as static code injection (CWE-96). It is the company's fourth N-central hotfix in five weeks for the remote monitoring and management (RMM) platform, shipped as 2026.3 Hotfix 4 (build 2026.3.1.14) in the early hours of September 6, 2026.

N-able's own communications disagree on whether the flaw has been exploited. Its incident notice says the vulnerability has been exploited in the wild, while its Hotfix 4 release notes say exploitation is unconfirmed and that the bug was responsibly disclosed through its security program. Hosted N-central (NCOD) instances have already been patched; on-premises customers are told to upgrade to 2026.3.1.14 immediately, with direct upgrade paths from 2025.4, 2026.1, 2026.2, 2026.3, and the 2026.3.1 hotfixes. Agents do not need upgrading to be protected from this specific CVE.

The advisory ships with no indicators of compromise, no interim mitigation, and no detection guidance beyond auditing N-central user accounts for unexpected users. Huntress, which has tracked attacks on N-central since August, advises restricting inbound console access with IP allowlisting or a VPN and, where a server remains internet-reachable, considering taking it offline until the hotfix is applied.

Why is an RMM flaw like this so serious?

Because RMM platforms are built to control fleets of machines. N-central is used by managed service providers to monitor, patch, and administer thousands of downstream endpoints, so an unauthenticated RCE on the N-central server can become a path to every customer environment it manages. That leverage is exactly why RMM tools are repeatedly targeted, and why a 10.0 on the management server deserves emergency handling rather than a normal patch cycle.

What should N-central admins do right now?

Upgrade on-premises servers to 2026.3.1.14 immediately, even if you applied Hotfix 3 the day before, because Hotfix 3 does not fix this bug. Until the upgrade is done, restrict inbound access to the console with IP allowlisting or a VPN, and take internet-exposed servers offline if you cannot patch quickly. Audit N-central user accounts for unexpected additions, since that is the only detection step the vendor offers given the absence of published indicators.

Our read

A 10.0 unauthenticated RCE on an RMM server is one of the highest-leverage bugs an MSP can face, because compromise of the management plane cascades to every managed endpoint. The mixed messaging on exploitation is itself a reason to act, not wait: when a vendor's own incident notice says in-the-wild while its release notes say unconfirmed, defenders should assume the worse case for an internet-reachable console. The durable posture is to keep RMM management planes off the public internet behind allowlisting or a VPN, patch them on an emergency track, and verify that the server cannot be reached by an unauthenticated attacker in the first place.

Reporting by The Hacker News; scoring and fix data per N-able's advisory; mitigation guidance per Huntress. Sources linked above.

Related: What is privilege escalation? and How to prioritize vulnerabilities.