CybersecurityVulnerability Management

N-able Patches Remote Code Execution Flaw in N-central Platform

Analyst 207||Source: InfoSecMag
Rows of computer servers and networking equipment in a brightly-lit server room.

CVE-2026-86218 was allocated a maximum-severity rating (CVSS) of 10, a designation reserved for the most critical software flaws.

CVE-2026-86218: a critical pre-authentication remote code execution in N-central

On September 6, N-able disclosed CVE-2026-86218, describing it as a critical pre-authentication remote code execution (RCE) vulnerability in N-central, the vendor’s remote monitoring and management platform. According to the advisory, the flaw affects N-central versions before 2026.3.1.14 and can allow an unauthenticated attacker to execute code on the N-central server.

N-able’s remediation: N-central 2026.3 Hotfix 4 (build 2026.3.1.14)

N-able published a new hotfix — N-central 2026.3 Hotfix 4 — which includes a patch for CVE-2026-86218 and brings affected instances to build 2026.3.1.14. The company has not publicly disclosed the affected component or the exploitation method for this vulnerability, and said it has found no evidence that CVE-2026-86218 has been exploited in production environments.

Five vulnerabilities in a matter of weeks: the immediate patch history

  • CVE-2026-18556 and CVE-2026-18577: Both were characterized as high-severity authentication bypasses that were found to have been exploited earlier in 2026; those two were added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog in August. Patches for those flaws were included in N-able’s HF1 and HF2 hotfixes, published on August 2 and August 6, respectively.
  • CVE-2026-86207 and CVE-2026-86206: N-able described CVE-2026-86207 as a high-severity authentication bypass affecting internal-only APIs, and CVE-2026-86206 as a high-severity access-control filter bypass exposing internal APIs. Both were patched in N-able’s HF3 hotfix on September 5.
  • CVE-2026-86218: Patched in HF4 (N-central 2026.3 Hotfix 4), published on September 6, bringing the build to 2026.3.1.14.

What this means for technologists, policymakers, and procurement leaders

  • Technologists and security teams: Organizations running N-central versions prior to 2026.3.1.14 should prioritize applying N-central 2026.3 Hotfix 4 to remediate CVE-2026-86218 and verify system builds. Given that two earlier flaws (CVE-2026-18556 and CVE-2026-18577) were added to CISA’s KEV catalog in August, teams will likely treat recent N-able patches as high-priority updates.
  • Policymakers and regulators: The inclusion of two N-able vulnerabilities in the CISA KEV catalog in August signals that at least some recent N-able flaws were observed in the wild. Regulators tracking known-exploited vulnerabilities will note the rapid succession of fixes released across HF1–HF4 in August and September.
  • Procurement and affected enterprises: Customers and procurement leaders who rely on N-central should account for a concentrated set of fixes across multiple hotfixes (HF1 through HF4) and ensure internal update processes capture the move to build 2026.3.1.14.

A narrow fact pattern, an open detail

N-able has released HF4 to patch a critical RCE and stated it has found no evidence of production exploitation. The company, however, did not disclose which component was affected or how the flaw could be exploited. That omission leaves a tangible question: will N-able publish technical details about the affected component or exploitation method to help defenders validate mitigations and hunting efforts? For now, the concrete next step detailed in the record is the availability of N-central 2026.3 Hotfix 4 (build 2026.3.1.14) as the vendor-provided remedy.

Original reporting: https://www.infosecurity-magazine.com/news/nable-hotfix-critical-rce/

Emerging ThreatsPatch ManagementRemote Code ExecutionVulnerability ManagementPre-AuthenticationRCECVSSN-ableN-centralCVE-2026-86218
Related Intelligence

Continue Reading

Vehicle with obscured license plate, partially covered in matte material, parked in empty urban setting with Flock camera…

Vehicles Cloaked to Evade Flock Camera Surveillance

A recent test has raised eyebrows, showing that a specially designed camouflage can evade detection by Flock cameras and Axon body cameras, sparking questions about the effectiveness of other surveillance technologies. Will upgrades to these systems be enough to catch visually altered vehicles, or will new methods be needed to stay one step ahead?

Analyst 207
Empty office cubicle with laptop, smartphone, and papers on a desk, surrounded by other cubicles and a window with natural…

NCSC Warns of Shadow AI Security Risks

Employees are increasingly turning to AI tools outside of company-approved systems, a phenomenon known as "shadow AI," which poses significant security risks. A staggering 71% of UK employees have already admitted to using unauthorized AI tools at work.

Analyst 207
Cluttered workstation with computer and technical equipment in a neutral room.

Telerik UI Flaw Exposes Unauthenticated RCE Risk

A newly discovered flaw in Telerik UI for ASP.NET AJAX can be exploited to achieve unauthenticated remote code execution, thanks to a publicly released proof-of-concept that combines an AES-CBC padding oracle with a type-resolution bug in the RadAsyncUpload control. When certain preconditions are met, this vulnerability can be easily leveraged for devastating effect.

Analyst 207
Rows of servers and storage units in a data center, with some cables exposed and others neatly organized.

Cloud Security Risks Diverge Sharply Across Providers

The cloud security landscape is far from equal, with a staggering 76% of AWS accounts showing exposed services, compared to just 8% on Google Cloud - a massive gap that highlights the limitations of one-size-fits-all cloud security checklists. This stark disparity underscores the need for a tailored approach to cloud security, one that takes into account the unique risks of each provider.

Analyst 207