N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform.
IT departments and managed service providers (MSPs) use the N-central platform to monitor, manage, and maintain client networks and devices from a centralized web-based console.
Tracked as CVE-2026-86218, this RCE vulnerability allows threat actors without privileges to execute malicious code on unpatched N-central instances exposed online in low-complexity attacks.
N-able addressed the flaw on Saturday by releasing N-central 2026.3 Hotfix 4 and urging customers to patch as soon as possible.
“At this time, we have no confirmations that this vulnerability has been exploited in production environments, but unpatched systems remain at risk,” the company said.
“Customers running on-premises N-central deployments should upgrade to N-central 2026.3 HF4 immediately to protect their environment.”
Internet security nonprofit Shadowserver Foundation now tracks nearly 1,500 N-central servers exposed online, most of them located in the United States and Europe.
While N-able has yet to confirm that the CVE-2026-86218 flaw is being targeted, cybersecurity company Huntress has flagged it as a potential zero-day, along with two high-severity vulnerabilities (tracked as CVE-2026-86206 and CVE-2026-86207, and also patched over the weekend) that can allow attackers to bypass authentication and gain full access to the vulnerable N-central platform.
“In our 9/5/26 update [..], we had said we could not rule out whether the two previous vulnerabilities released (CVE-2026-86206 and CVE-2026-86207) were the ones that were exploited in the instance seen in the patched production environment of one of our customers,” Huntress said.
“Because logs on the compromised N-central server had already rotated, we are also unable to say whether this new CVE was the vulnerability exploited in that case.”
“On-premises N-central users must apply HF4 immediately, as systems running HF3 remain vulnerable to this newly disclosed flaw,” Huntress warned.
One year ago, N-able released security updates for two N-central vulnerabilities (CVE-2025-8875 and CVE-2025-8876) that attackers were exploiting in the wild.
Days later, Shadowserver found that 880 N-central servers were still vulnerable to attacks exploiting the two security flaws even after CISA ordered federal agencies to patch their systems within a week and urged all security teams to also prioritize securing their systems against ongoing attacks.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
SonicWall warns of actively exploited SMA1000 zero-day flaws
CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws
Critical Elementor Pro flaw exploited to take over WordPress sites
Hackers exploit Sangoma Switchvox flaw to deploy reverse shells
Critical Langflow flaw exploited to steal OpenAI and AWS keys
New CrowdStrike ‘FalconFlank’ zero-day grants SYSTEM privileges
Google warns of new Chrome zero-day flaw exploited in attacks
IDScan sued over alleged data breach affecting 153 million drivers
Unify ransomware protection and recovery for every client
Identity, Data Governance & Threat Detection in One Platform: Take our In-Browser Tour
See how attackers exploit passkey enrollment, and why hardware-bound biometrics raise enterprise identity assurance.
Can you trust every session? See how session enrichment enables better authentication decisions.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
