Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-86218 |
| Alert source | CISA KEV - actively exploited vulnerability |
| CVE year | 2026 |
| Publication date | 2026-09-08 |
| Vendor | N-able |
| Product | N-central |
| Affected versions | all prior to 2026.3.1.14 |
| Fixed version | 2026.3.1.14 |
| CVSS Score | 9.8 (Critical) |
| EPSS Score | 0.41% (34th percentile) |
| CISA KEV | Yes |
| CISA deadline | 2026-09-11 |
| Ransomware | Not confirmed |
Vulnerability Description
The N-able N-central platform contains a flaw allowing unauthenticated remote code execution. It affects all versions prior to 2026.3.1.14. The attacker needs no credentials — network access to the N-central server is sufficient.
Why this is worse than a typical 9.8. N-central is an RMM (remote monitoring and management) platform — the tooling IT service providers use to manage their clients’ infrastructure. By design it has:
- agents on managed endpoints, running with high privileges,
- the ability to run scripts and install software remotely,
- access to many separate client networks from a single point.
Each of these properties makes sense for administration, and each becomes a weapon once the server is taken over. Compromising N-central therefore does not end with one system — it is a path into the entire managed fleet. This is the same class of risk seen in high-profile attacks on managed service providers: the attacker does not attack a hundred companies one by one, but a single tool that already has access to them.
The vulnerability is already being exploited — CISA has added it to the Known Exploited Vulnerabilities catalog with a deadline of 11 September 2026.
Required Actions
- Update N-central to version 2026.3.1.14 or later. This is the only complete fix; all earlier releases are vulnerable.
- Restrict network access to the N-central console. The management interface of an RMM platform should not be reachable from the whole internet. If it is, limit it to known addresses or place it behind a VPN, regardless of the update.
- Check whether compromise has already occurred. With a pre-auth flaw under confirmed exploitation, the review must come before the assumption. Look for: new administrative accounts, unplanned tasks and scripts executed on endpoints, unusual console logins, and changes to automation policies.
- Review the history of jobs run on managed endpoints. If an attacker had access to the server, the most likely next step was pushing a task to the fleet. That leaves a trace in the execution history — and that is where to look for it.
- Rotate credentials used by the platform. Service accounts, API keys and integrations with other systems should be treated as potentially exposed unless the review rules out compromise conclusively.
Who Is Affected?
Directly: any organisation running its own N-able N-central server on a version earlier than 2026.3.1.14. In practice these are mainly IT service providers, integrators, and in-house IT departments at larger companies that use N-central to manage a distributed fleet of workstations and servers.
Indirectly — and this part is often overlooked — any company whose infrastructure is looked after by an external IT provider. If that provider uses N-central, their vulnerable server is a route into your network, no matter how well patched your own systems are.
This is a good moment to ask your provider three specific questions: which RMM tool do they use, which version is it on, and when was it updated after this advisory. “We have it under control” is not an answer to any of them.
Sources
- NVD - CVE-2026-86218
- CISA Known Exploited Vulnerabilities Catalog
- N-able Security Advisory - CVE-2026-86218
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
