N-able Pre-Auth RCE, Magento StyleSmuggler Zero-Day, and MikroTik MikroTrick Router Takeovers

N-able released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) over the weekend to address CVE-2026-86218, a maximum-severity pre-authentication remote code execution vulnerability in its widely used remote monitoring and management (RMM) platform. The flaw is described as a static code injection issue (CWE-96) that can let an unauthenticated attacker execute code on the N-central server itself.

This is especially dangerous because N-central sits at the center of many managed service provider and enterprise environments—compromising one instance can give attackers a push channel into thousands of managed endpoints. Shadowserver has tracked roughly 1,500 internet-exposed N-central servers. N-able’s communications have mixed messaging on active exploitation (some notices reference wild exploitation; release notes call it unconfirmed), but security firms including Huntress have treated related recent N-central flaws as high-priority. Hosted NCOD instances are already patched; on-premises customers on anything before 2026.3.1.14 (including those who just applied Hotfix 3) must upgrade immediately. Direct upgrade paths exist from several recent versions.

Action items : Inventory every N-central instance, confirm the build, apply HF4, and monitor for anomalous activity. This continues a rapid sequence of critical patches for the product in recent weeks.

StyleSmuggler: Unpatched Magento & Adobe Commerce Zero-Day Under Active Exploitation

Sansec disclosed StyleSmuggler on September 5 after observing attacks that began September 4. This unauthenticated remote code execution vulnerability affects Magento Open Source and Adobe Commerce, including current versions such as 2.4.9. Researchers reproduced the full chain on clean installs of 2.4.7, 2.4.8, and 2.4.9; the first observed victim was running a fully patched 2.4.6-p15.

The exploit abuses Magento’s template system (via “styles” properties and related mechanisms) in a two-stage process: first poisoning logs or reports with attacker-controlled PHP, then triggering execution (often via a failed-payment email path). No official Adobe patch existed at the time of reporting (the scheduled bulletin was expected around September 8). Attackers are planting backdoors on store servers, putting customer data and checkout flows at risk.

Action items : Check for compromise immediately (look for unexpected files outside the webroot, anomalous logs, or new admin activity). Deploy temporary mitigations such as WAF rules or GraphQL restrictions where feasible, and prepare for the official fix. E-commerce operators should treat this as an active incident-response priority.

MikroTik RouterOS “MikroTrick” Chain Actively Hijacking Exposed Devices

CERT Polska warned that attackers are chaining two critical SSH vulnerabilities in MikroTik RouterOS (collectively called MikroTrick) to gain full administrative control of internet-exposed routers. Exploitation has been observed since at least September 2—before public disclosure and, in some cases, before patches were fully rolled out.

CVE-2026-67276 is an SSH authentication bypass stemming from incomplete RSA public-key validation (RouterOS checked type and modulus but not the full key/exponent). CVE-2026-86060 enables privilege escalation via specially crafted usernames. Together they allow unauthenticated takeover when SSH is reachable from the internet. A third related issue affects the bandwidth-test service. MikroTik shipped fixes in 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Indicators include log entries such as “user added by ssh:-2@” and creation of a privileged “ops” account; specific source IPs have been noted in attack traffic. Hundreds of thousands of potentially vulnerable devices remain online.

Action items : Restrict SSH to trusted networks or disable it if not required, apply the latest RouterOS updates, and inspect configurations for unknown users, scripts, or “Flagged” status. Compromised devices can serve as pivots or botnet nodes.

These three issues a common theme: high-impact, remotely reachable flaws in widely deployed infrastructure (RMM platforms, e-commerce stacks, and networking gear) that are already seeing real-world abuse or urgent patching. Prioritize exposure reduction and rapid remediation.

Discussion this post