Remote Code Execution Vulnerability in N-central by N-able
CVE-2026-86218

10CRITICAL

Key Information:

Vendor: N-able
Status: N-central
Vendor: CVE Published:; 6 September 2026

Badges

📈 Score: 810💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 12%🦅 CISA Reported📰 News Worthy

What is CVE-2026-86218?

CVE-2026-86218 is a remote code execution vulnerability identified in N-central, a systems management and monitoring software developed by N-able. This software is commonly utilized by IT service providers to manage client networks, software deployments, and security solutions. The vulnerability arises from a flaw in the pre-authentication process, which enables attackers to execute arbitrary code on servers running versions of N-central prior to 2026.3.1.14. The implications of this vulnerability are significant, as it could allow malicious actors to gain unauthorized access, control systems, and potentially escalate their privileges, leading to extensive damage or data compromise within an organization.

Potential Impact of CVE-2026-86218

Unauthorized Remote Access: Exploitation of this vulnerability could permit attackers to execute arbitrary commands remotely, offering them complete access to the operational environment. This could lead to unauthorized modifications, data exfiltration, or disruption of services.
Data Breach Potential: With the ability to execute arbitrary code, attackers could potentially access sensitive information stored within the system, leading to severe data breaches that could compromise client data and business operations.
Widespread Distribution of Malware: Successful exploitation may enable threat actors to deploy malware across affected machines, facilitating further attacks, including ransomware deployment or lateral movement within the network, significantly increasing the risk to the organization's overall security posture.

CISA has reported CVE-2026-86218

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-86218 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

N-central 0 < 2026.3.1.14

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-86218
Created by HORKimhab

CVE-2026-86218
Created by Udyz

News Articles

Help Net Security

CVE-2026-86218 CVE-2026-20079

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited - Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Zero trust AI agents demand a different kind of security

2 weeks ago