N-able N-central CVE-2026-86218: Pre-Auth RCE on the MSP Brain (CVSS 10)

Your MSP’s remote-management brain just became a pre-auth takeover story. A maximum-severity flaw in on-prem N-able N-central lets an unauthenticated attacker run code on the server that manages every customer endpoint you touch.

If you still run N-central below the fixed hotfix build, treat this as an incident triage — not a weekend patch window.

What happened

On September 6, 2026, N-able shipped Hotfix 4 (build 2026.3.1.14) for a critical static code-injection bug tracked as CVE-2026-86218 (CVSS 10.0). The flaw sits in a public-facing application endpoint and allows remote code execution before authentication.

Separately, Rapid7 Labs disclosed two related authentication-bypass bugs (CVE-2026-86206 and CVE-2026-86207, fixed earlier in Hotfix 3, build 2026.3.1.13) that, chained together, let an unauthenticated attacker create an attacker-controlled System administrator account. At release N-able said it had no confirmation of in-the-wild exploitation of CVE-2026-86218, but CISA added it to KEV on September 8, 2026 (federal due date September 11), which means CISA has evidence of active exploitation.

Hosted N-central Online environments were patched by N-able. On-premises servers remain the operator’s job.

Why it matters

N-central is the MSP control plane: agents, scripts, credentials, and remote shells into customer estates. Compromising it is how a single internet-facing console becomes a multi-tenant ransomware or data-theft amplifier.

Pre-auth RCE plus account-creation bypasses means “we patched later” is not the same as “we were never owned.” Hunt first if the box was reachable.

What to do first

• Upgrade every on-prem N-central server to 2026.3.1.14 (Hotfix 4) or later from the N-able Support portal. Confirm the build in the console — do not trust a ticket that only says “updated.”
• If you cannot patch tonight: firewall the web UI to trusted IPs/VPN only, segment the server, and enforce MFA on admin access (partial mitigation only).
• Audit administrative accounts for strangers — especially users with emails ending in .invalid — and rotate admin/service credentials if anything looks off.
• Review agent integrity and recent script/job pushes into customer tenants. Assume downstream exposure until proven otherwise.
• Preserve logs before wipe/rebuild if compromise is suspected; MSPs should notify affected customers per contract and law.

Details

• CVE: CVE-2026-86218 (CVSS v4 10.0; v3.1 9.8); related auth bypasses CVE-2026-86206 / CVE-2026-86207
• Product: N-able N-central (on-premises) prior to 2026.3.1.14
• Class: Static code injection / pre-auth RCE on a public endpoint (CWE-96 class)
• KEV: Added 2026-09-08
• Fixed: Hotfix 4 — 2026.3.1.14+ (supersedes Hotfix 3)
• Hosted: N-central Online patched by vendor

Hunt / verify

• Confirm build ≥ 2026.3.1.14 on every on-prem node.
• Diff admin user lists against a known-good export; flag .invalid emails and unexpected MFA resets.
• Review web access logs for anomalous pre-auth hits and new console sessions from unfamiliar geos/ASNs.
• Check recent mass script deployments and credential vault changes across customer sites.

Sources

• Arctic Wolf: CVE-2026-86218 — N-able N-central pre-auth RCE (Sep 8, 2026)
• N-able status: N-central 2026.3 Hotfix 4
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-86218
• Rapid7: CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
• NVD: CVE-2026-86218

Correction (Oct 10, 2026): An earlier version said exploitation was observed before disclosure and implied CVE-2026-86218 is chained with CVE-2026-86206/86207. N-able reported no confirmed exploitation at release (CISA later listed it in KEV), and the Rapid7 chain is 86206 + 86207 only. The CVSS 10.0 score is CVSS v4. The Rapid7 source link was also wrong and now points to Rapid7’s actual write-up.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].