Skip to content
Actively exploitedCVSS 9.8 · CRITICAL

CVE-2026-86218Pre-auth RCE in N-able N-central

N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.

View on NVD

Analysis

N-able N-central is vulnerable to a pre-authentication remote code execution (RCE) due to a static code injection flaw. This vulnerability is actively being exploited in the wild, allowing attackers to take control of the management server without credentials.

Relevant roles

ciberseguridadCloudLinuxWindows

Severity

Score: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Weakness (CWE): CWE-96

CISA KEV

Added to KEV: 2026-09-08
Federal patch deadline: 2026-09-11
Known ransomware use: Unknown
Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

EPSS

Probability of exploitation (next 30 days): 0.0041 (0.4%)
Percentile: 34.3%
EPSS: 2026-09-08

Affects

n-able:n-central

Technical description

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

Published: 9/6/2026, 3:17:17 AM
Last modified: 9/8/2026, 7:28:43 PM

References

HomeEventsBlogResourcesCoursesTeam