N-able rushes out a fix for a critical RCE flaw in N-central

N-able has released an emergency hotfix for a maximum-severity vulnerability in N-central, its remote monitoring and management (RMM) platform. The product is used by IT departments and managed service providers (MSPs) to centrally monitor and service client networks and devices through a web console.

The vulnerability has been assigned the identifier CVE-2026-86218. It falls into the remote code execution (RCE) class and allows an attacker with no privileges whatsoever to run malicious code on unpatched, internet-facing N-central instances. The attack also requires little skill.

What to do

The issue was fixed on Saturday with the release of N-central build 2026.3 Hotfix 4. N-able strongly urges customers to update as soon as possible, especially those who deploy the platform on their own servers.

“At this time we have no confirmation that this vulnerability has been exploited in production environments, but unpatched systems remain at risk,” the company said. According to the Shadowserver Foundation, there are roughly 1,500 publicly accessible N-central servers, most of them in the US and Europe.

Signs of active attacks

While N-able itself has not yet confirmed exploitation, Huntress has flagged the vulnerability as a potential zero-day. Two more high-severity bugs were closed over the weekend alongside it — CVE-2026-86206 and CVE-2026-86207 — which allow authentication to be bypassed and full access to the platform to be gained.

Huntress had previously reported that it could not rule out exploitation of two earlier vulnerabilities in a compromised production environment belonging to one of its clients. By that point, however, the logs on the breached server had already been overwritten, so it was impossible to determine which flaw had been used — including whether it was a new one. Experts stress that systems running Hotfix 3 are still vulnerable, and HF4 must be installed immediately.

History is repeating itself: a year ago, N-able had already patched two actively exploited vulnerabilities in N-central (CVE-2025-8875 and CVE-2025-8876). Back then, even after CISA ordered federal agencies to update within a week, Shadowserver counted 880 servers still open to attack.

Source: Bleeping Computer