CISA Adds Critical N-able N-central RCE Vulnerability to Its Actively Exploited Catalog

On Tuesday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical flaw in the N-able N-central remote monitoring and management platform to its Known Exploited Vulnerabilities (KEV) catalog. Federal Civilian Executive Branch (FCEB) agencies have been ordered to apply the fixes no later than September 11, 2026.

The vulnerability in question is CVE-2026-86218, which carries the highest possible CVSS score — 10.0. It is classified as static code injection and, according to CISA's description, allows arbitrary code to be executed remotely and without authentication. The patch shipped as part of N-central 2026.3 Hotfix 4, released on September 5, 2026.

Attacks Already Observed

In a separate “urgent” advisory sent directly to customers, N-able reported that CVE-2026-86218 was “observed being exploited in the wild.” The company said it is actively investigating the situation, has taken additional measures to protect customer environments, and strongly recommends applying the fix immediately.

The trigger was an investigation launched by Huntress after a fully patched N-central production environment belonging to one of its customers was compromised on September 4, 2026. It remains unclear, however, whether CVE-2026-86218 itself was involved or two other vulnerabilities — CVE-2026-86206 and CVE-2026-86207 — that N-able closed the same day in Hotfix 3.

According to Stephen Fewer of Rapid7, who discovered and reported those two bugs, they can be chained together: a remote, unauthenticated attacker gains the ability to bypass authentication and create a new system administrator account under their control on the vulnerable server.

Huntress was unable to determine conclusively which exploit was used. The reason is limited historical logging on the device itself: the specialists can neither confirm the specific vector nor rule out the use of other vulnerabilities.

It is worth noting that this is already the fourth hotfix for N-central released in five weeks aimed at eliminating a possibility of unauthenticated remote code execution — a worrying sign for a platform that by its very nature has broad access to managed infrastructures.

Source: The Hacker News