CVE-2026-86218: N-able N-central Improper Neutralization of

CVE-2026-86218 is a maximum-severity (CVSS 10.0) pre-authentication remote code execution vulnerability in N-able N-central, affecting all versions prior to 2026.3.1.14. An unauthenticated attacker with network access can execute arbitrary code on N-central servers, potentially compromising every managed endpoint under that platform's control. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Organizations running affected versions should prioritize patching to version 2026.3.1.14 or later.

CRITICAL exposure, scored 93/100 against the rubric below.

100% of the rubric is evidenced, 100% of it from independent authorities.

TREAT AS CRITICAL for triage and prioritization.

Work down this list against your own estate. These are conditions to check, not findings you. We can't see your environment.

Treatment rationale: The combination of active exploitation, pre-authentication attack surface, and cascading blast radius across all managed endpoints makes deferral or acceptance indefensible — immediate patching to N-central 2026.3.1.14 or network isolation of exposed instances is the only proportionate response.

Third-Party / Supply-Chain Risk

Loss Exposure (illustrative)

Insurance / Contractual / Legal — Potential Obligations

Potential triggers, not legal determinations. Verify with counsel/broker before acting.

CVE-2026-86218 is a Static Code Injection vulnerability (CWE-96) in N-able N-central affecting all versions before 2026.3.1.14.

The CVSS v4.0 base score is 10.0 (Critical), with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, indicating network-accessible exploitation requiring no privileges, no user interaction, and no attack complexity.

All confidentiality, integrity, and availability impacts are rated High for both the vulnerable system and downstream systems.

The vulnerability permits pre-authentication remote code execution; an unauthenticated attacker can inject and execute code on the N-central server. Because N-central is a remote monitoring and management (RMM) platform, successful exploitation could cascade to all managed endpoints. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of the NVD record date. No exploitation activity, exploit mechanics, or indicators of compromise were confirmed in the available evidence at time of writing.

Action Checklist IR ENRICHED

After patching to N-central 2026.3.1.14 and completing credential rotation, maintain elevated monitoring on all N-central managed endpoints for a minimum of 30 days using Sysmon Event ID 1 and 3 to detect delayed persistence activation or second-stage payload execution that may have been pre-staged during the exploitation window. Validate N-central service integrity weekly for the first month by comparing file hashes of the N-central application binaries against known-good hashes from the vendor's release package. Do not restore full N-central management functionality to internet-facing endpoints until network segmentation controls (VPN/ZTNA requirement) have been validated by an independent review.

Key Forensic Artifacts

No IOCs or specific exploit indicators were available in the source material at time of writing.

Defenders should focus on behavioral detection: monitor N-central application and web server logs for unauthenticated requests that trigger unexpected server-side activity, unusual process execution originating from the N-central service account, and any outbound network connections from the N-central host to external destinations not associated with normal RMM operations.

Check for new or modified files in N-central's application directories, unexpected scheduled tasks, or new local accounts created on the host.

SIEM correlation rules should flag privilege escalation events or lateral movement originating from the N-central server to managed endpoints. NIST SI-4 (System Monitoring) and AU-6 (Audit Record Review, Analysis, and Reporting) provide the control framework for this detection posture.