N-able ships emergency N-central hotfix for CVSS 10 flaw CVE-2026-86218

N-able has patched a pre-authentication remote code execution flaw in N-central, the remote monitoring and management platform MSPs and IT departments use to run client fleets from one console. The fix is N-central 2026.3 Hotfix 4, build 2026.3.1.14, posted to the vendor status page on 6 September 2026.

The flaw is tracked as CVE-2026-86218 and carries a CVSS v4.0 base score of 10.0, assigned by N-able as the CVE Numbering Authority for its own products. CISA and the vendor both describe it as a static code injection issue leading to pre-authentication remote code execution on the N-central server.

Every build below 2026.3.1.14 is affected. Hosted instances, which N-able runs as NCOD, were patched by the vendor before disclosure. Self-hosted deployments must install the hotfix themselves, and that includes anyone who applied Hotfix 3 the previous day.

N-able has published no root-cause detail for CVE-2026-86218 beyond the static code injection label, so there is no public mechanism analysis. watchTowr told The Hacker News it reproduced the flaw and that changes made on a compromised N-central instance propagate to connected systems.

The two flaws fixed a day earlier are documented in full. Rapid7's Stephen Fewer found that a semicolon in the request path slips past the Envoy proxy's block on internal API routes, because Jetty later strips it and resolves the path to the protected SOAP servlet. A malformed Forwarded header does the rest, since Jetty reads it as a loopback address while N-central's own parser fails open on the invalid value.

From there, a legacy two-factor method binds a requested user ID to the session before authentication runs. Built-in accounts throw an exception, the binding survives, and the session becomes privileged. Rapid7 rates that pair at 6.9 and 7.7 on CVSS v4.0.

An RMM server is a management plane with standing authority over other people's networks. Once code runs on it, an attacker inherits the platform's normal powers: push scripts to managed endpoints, deploy tooling through the agent, open remote sessions into servers, and change roles and policies to keep access.

The exposure is measurable. Shadowserver tracks close to 1,500 internet-facing N-central servers, most of them in the United States and Europe. Each one sits in front of an unknown number of client environments.

watchTowr's Yordan Ganchev told The Hacker News that this profile is exactly what makes N-central valuable to ransomware crews, since compromising it grants access to connected computers and downstream systems. Huntress made the same point in operational terms during the August wave, noting that the appliance runs a custom AlmaLinux build and rarely carries EDR.

The vendor has said two different things. The Hotfix 4 release notes state that exploitation in production environments is not confirmed. The urgent notice sent to customers, and a message from N-able's Jason Murphy in the MSPGeek community, describe a zero-day already exploited in the wild.

Huntress flagged the contradiction directly in its rapid response post, having received the second version first. Its own investigation began on 4 September after a customer's fully patched N-central production environment was compromised. Because appliance logs had already rotated, Huntress could not confirm which flaw the intruder used, and could not rule out others.

CISA settled the practical question on 8 September by adding CVE-2026-86218 to its Known Exploited Vulnerabilities catalog, with an 11 September deadline for federal civilian agencies.

Install build 2026.3.1.14 on every self-hosted instance, including any that received Hotfix 3 on 5 September. N-able lists direct upgrade paths from 2025.4 through Hotfix 2, and older builds need an intermediate hop first. Hosted NCOD customers have nothing to install.

Patching is the floor, not the response. Huntress recommends auditing user lists for accounts created without authorisation, particularly email addresses with an appended .invalid string or subtle domain swaps meant to survive a quick glance. It also points defenders at the appliance logs below, filtering for successful requests to internal API routes containing URL-encoded values such as %2F.

envoy_proxy_HTTPS.log
syslog ncentraldms

Finally, take the console off the public internet. Huntress advises IP allowlisting or a mandatory VPN even after patching, and says taking N-central offline is a reasonable option for exposed, unpatched deployments.

This is the third distinct N-central security event since the start of August. Hotfixes 1 and 2 answered CVE-2026-18556 and CVE-2026-18577 in early August, Hotfix 3 answered the Rapid7 chain, and Hotfix 4 answered a flaw reported independently by a third party.

A cadence like that usually means researchers are actively digging through the same product, and that more findings are queued behind the ones already public. For anyone running N-central, the operational conclusion is to treat vendor advisories for this platform as an out-of-band process rather than a monthly cycle.

The other thing worth watching is whether root-cause detail for CVE-2026-86218 ever appears. Without it, defenders are hunting on tradecraft rather than on the mechanism, and detection stays reactive.