HotFix for N-able N-central CVE-2026-86218

The Threat

On September 6th, 2026, N-able disclosed and patched three critical and high-severity vulnerabilities in the N-central RMM platform, with one flaw confirmed exploited in the wild. The exploited vulnerability is tracked as CVE-2026-86218 (CVSS: 10). The vulnerability is a pre-authentication Remote Code Execution (RCE) flaw that would allow a remote and unauthenticated threat actor to execute code on vulnerable assets. N-able and security researchers have confirmed real-world exploitation.

As exploitation is ongoing, it is critical that impacted organizations apply the N-able hotfix immediately.

What We're Doing About It

• eSentire's Managed Vulnerability Service (MVS) will add relevant plugins as they become available
• eSentire customers can employ the Vulnerabilities and Inferred Vulnerabilities pages in Atlas Portal to search for potentially vulnerable assets
• Known Indicators of Compromise (IoCs) have been added to eSentire's Threat Intelligence Platform (TIP)
• The Threat Response Unit (TRU) has developed MDR for Network detections to identify exploitation of CVE-2026-86206
• eSentire's Threat Response Unit (TRU) is tracking this topic for additional information and detection opportunities

What You Should Do About It

• After performing a business impact review, apply N-central 2026.3 Hotfix 4 (build 2026.3.1.14)
  • Hosted N-central environments have already been patched by N-able and require no action
• Audit N-central accounts for unauthorized additions and unexpected account modifications
• Restrict inbound access to N-central consoles

Additional Information

According to N-able, independent security researchers have reported attacks targeting CVE-2026-86218. Huntress has confirmed attacks exploiting vulnerabilities in fully patched N-able N-central instances but did not specify which vulnerability was exploited in the attacks.

The two other vulnerabilities addressed in this hotfix are:

• CVE-2026-86206 (CVSS: 6.9) - A vulnerability in the N-central internal API access control filter allows unauthorized access to internal APIs
• CVE-2026-86207 (CVSS: 7.7) - An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs

These two vulnerabilities could be chained together, enabling an unauthenticated remote attacker to reach privileged internal SOAP/API endpoints and create a new System Administrator account on the N-central server. Exploitation of these vulnerabilities has not been positively confirmed at the time of writing, but technical details were disclosed. The release of technical information or Proof-of-Concept (PoC) exploit code lowers the barriers for threat actors to develop their own exploits and increases the likelihood of real-world attacks.

This is the fourth hotfix that N-able has released since August 2nd, 2026. The repeated targeting of new vulnerabilities indicates a high level of attacker interest. Organizations must apply the hotfix immediately and are encouraged to monitor N-able for additional releases.

References:

[1] https://uptime.n-able.com/event/201814/
[2] https://nvd.nist.gov/vuln/detail/cve-2026-86218
[3] https://www.huntress.com/blog/n-able-vulnerability-exploitation
[4] https://nvd.nist.gov/vuln/detail/cve-2026-86206
[5] https://nvd.nist.gov/vuln/detail/cve-2026-86207
[6] https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/