Critical RCE Vulnerability in N-able N-central Requires Immediate Patching

N-able has released Hotfix 4 for its N-central platform to address CVE-2026-86218, a critical remote code execution (RCE) vulnerability rated CVSS 10.0. This flaw allows unauthenticated attackers to execute arbitrary code on N-central servers running versions prior to 2026.3.1.14. The vulnerability has been reported as being actively exploited in the wild, raising urgent concerns among managed service providers (MSPs) and IT teams. N-able's communications have been inconsistent regarding whether the vulnerability has been confirmed as exploited, with some reports indicating it has been observed in active attacks. Organizations using on-premises N-central installations are urged to upgrade immediately to mitigate risks. The situation is compounded by a series of vulnerabilities disclosed in recent weeks, including CVE-2026-86206 and CVE-2026-86207, which also require urgent attention. The ongoing threat landscape necessitates vigilant monitoring and prompt patching of affected systems.

Key Points: • CVE-2026-86218 is a critical RCE vulnerability with a CVSS score of 10.0. • N-able's N-central versions prior to 2026.3.1.14 are affected and should be patched immediately. • There are conflicting reports on whether the vulnerability has been actively exploited.