N-central Pre-Authentication Remote Code Execution

N-able’s N-central remote monitoring and management platform contains a pre-authentication remote code execution vulnerability in all versions before 2026.3.1.14. Classified as CWE-96 (static code injection), the flaw allows an unauthenticated attacker with network access to the server to execute arbitrary code on the host. No credentials and no user interaction are required.

N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) to oversee the IT environments of multiple client organizations from a single management console. An MSP running N-central typically has privileged agent access to dozens or hundreds of client endpoints. Unauthenticated RCE on the N-central server gives an attacker access that extends across the whole managed fleet, not just the management server itself. RMM platforms are high-value targets for ransomware operators for exactly this reason: a single compromised console can reach every organization the MSP manages.

Static code injection (CWE-96) occurs when user-controlled or externally reachable input is written to persistent storage and later executed by the application, without the application treating that stored content as inert data. In N-central’s case, an unauthenticated network request can supply input that the server subsequently executes as code, with no authentication gate in the path.

The vulnerability is scored at CVSS 4.0: 10.0, the maximum, with a fully network-accessible attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). All confidentiality, integrity, and availability impact dimensions are rated high for both the vulnerable system and downstream managed endpoints.

N-able released version 2026.3.1.14 to address the flaw. No workarounds are documented in the advisory. Instances that cannot immediately receive the update should be isolated from external network access while the patch is staged.

CISA added CVE-2026-86218 to the Known Exploited Vulnerabilities catalog on September 8, 2026 with a remediation deadline of September 11, under BOD 26-04. The three-day window is the shortest of the four CVEs added to KEV on September 8, reflecting the broad attack surface of an internet-facing RMM platform with access to many client environments.

See the full coverage article for context on the exploitation risk in MSP environments.

September 8, 2026 CISA KEV Batch

CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog on September 8, 2026 in a single enforcement update. All four carry confirmed active-exploitation status. CVE-2026-86218 and CVE-2026-75650 share the most urgent deadline (September 11); the two Windows CVEs have until September 22:

• CVE-2026-75650: CVSS 10.0, Adobe Commerce and Magento Open Source template-engine injection, unauthenticated RCE, September 11 deadline
• CVE-2026-81963: CVSS 7.8, Windows Update Stack link-following privilege escalation, September 22 deadline
• CVE-2026-85880: CVSS 7.8, Windows ALPC heap buffer overflow, AppContainer sandbox escape, September 22 deadline
• CVE-2026-86218 (this entry): CVSS 10.0, N-able N-central pre-authentication RCE, September 11 deadline

CVE-2026-86218 and CVE-2026-75650 both carry the September 11 deadline because CISA assessed them as having the widest downstream blast radius in the batch: N-central reaches every client endpoint the MSP manages, and Adobe Commerce stores hold payment and customer data. The September 11 window is three days, the shortest permissible under BOD 26-04.

FAQ

What version of N-central is safe?

Version 2026.3.1.14 and later. N-able released this version to address the vulnerability. If your N-central instance is running any version before 2026.3.1.14, it is exposed. Check your current version in the N-central administrative interface and update immediately. No earlier version and no configuration change short of the patch closes the attack surface.

Is there a workaround if we cannot patch immediately?

N-able’s advisory does not document a supported workaround. The interim guidance is to isolate the N-central server from external network access while the patch is staged. Because N-central is an RMM platform typically exposed to the management network, blocking unauthenticated external access reduces the attack surface until the update can be applied. This is a temporary measure only: apply 2026.3.1.14 as quickly as possible.

Why is the CISA remediation deadline only three days?

CISA set a September 11 deadline (three days from the September 8 KEV addition) because N-central’s attack surface extends beyond the server itself. An MSP running N-central typically holds privileged agent access across dozens or hundreds of client environments from a single console. Unauthenticated RCE on that server is, effectively, unauthenticated access to every managed endpoint. Ransomware operators target RMM platforms specifically for this reason: a single compromise scales across an entire managed fleet. The three-day window reflects both the CVSS 10.0 severity and the downstream blast radius. Of the four CVEs added to the September 8 KEV batch, this one and CVE-2026-75650 (Adobe Commerce) share the shortest remediation window, both set to September 11, because broad downstream reach made CISA treat each as especially time-sensitive.