N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

CVE-2026-86218 is a pre-authentication remote code execution vulnerability in N-able N-central, the remote monitoring and management (RMM) platform widely used by managed service providers (MSPs) to administer client fleets. The flaw is classified as CWE-96 — static code injection — meaning an attacker can inject executable directives into server-side code without ever authenticating. Every on-premises N-central build prior to 2026.3.1.14 (Hotfix 4) is affected, including servers that applied HF3 just one day earlier. Hosted (NCOD) instances were pre-patched by N-able. Affected version ranges include 2025.4, 2026.1, 2026.2, and all 2026.3.x builds below HF4.

There is no official NVD CVSS 3.1 score yet, but N-able as CNA assigned a CVSS 4.0 score of 10.0 — the maximum. For once, a perfect-10 rating is not hyperbole. This is a zero-click, zero-auth, network-reachable RCE on a platform whose entire purpose is to push commands to thousands of downstream endpoints. N-able's own advisory hedges on in-the-wild exploitation ('no confirmations in production environments'), but Huntress independently confirmed exploitation and published IoCs including attacker infrastructure IPs. This is the fourth critical hotfix in five weeks for N-central, following the CVE-2026-18556 and CVE-2026-18577 auth bypass chain that Horizon3 and Huntress documented being used to compromise nine client organizations through a single N-central server. The pattern is clear: N-central's attack surface is under sustained, targeted assault.

Why this verdict

• Pre-auth, zero-click, network-reachable RCE — the attack requires no credentials, no user interaction, and no prior access. An attacker needs only HTTP(S) connectivity to the N-central web interface, which ~3,000 instances expose directly to the internet.
• Role multiplier: N-central is canonically a supply-chain/fleet-management component — 100% of N-central installations *are* the high-value role. Every instance manages hundreds to thousands of endpoints. Compromise of one server = command execution on every managed host across every client tenant. This is not a theoretical concern: Huntress documented exactly this cascade in the CVE-2026-18577 campaign one month ago. The blast radius is fleet-scale to supply-chain-scale.
• Attack surface under active siege — this is the fourth critical hotfix in five weeks. The prior CVEs (CVE-2026-18556, CVE-2026-18577) were confirmed exploited in the wild with documented victim impact. Threat actors are already tooled up against N-central infrastructure. Reverse engineering of HF4 to produce exploits for CVE-2026-86218 is expected within days, not weeks.
• Minimal friction in the real world — the only meaningful friction point is whether the N-central instance is internet-exposed. With ~3,000 instances on Shodan and MSP architectures that frequently require internet accessibility for remote client management, this friction point is weak. There is no authentication barrier, no user interaction requirement, and no complex preconditions.

Why not higher?

This is already assessed at the maximum severity (CRITICAL, 10.0). There is no higher bucket available.

Why not lower?

Downgrading below CRITICAL would require evidence that the supply-chain blast radius is theoretical rather than demonstrated — but Huntress has already documented multi-tenant compromise from a single N-central server in the prior CVE wave. The component is *definitionally* a fleet-management server (100% of installs occupy the high-value role), the attack is pre-auth and network-reachable, and the attacker community is already actively targeting this exact product. No friction point in the chain is strong enough to override the CRITICAL floor set by the supply-chain role multiplier.

1. Restrict N-central web interface to VPN or IP allowlist immediately — The attack requires network reachability to N-central's HTTPS port. Placing N-central behind a VPN or firewall allowlist eliminates the unauthenticated remote attack vector entirely. Deploy within the noisgate CRITICAL mitigation SLA of 3 days — preferably within hours given the active threat landscape.
2. Block known attacker infrastructure at the perimeter — Add Huntress-published IOCs to your firewall/proxy blocklists: 23.234.100[.]105, 23.234.97[.]68, Cloudflare tunnel account tag 5568cd69c754b392121f1dbb8f900fda. This is a stop-gap — expect new infrastructure — but buys time.
3. Enable enhanced logging and monitoring on N-central appliance — Monitor for anomalous API requests (URL-encoded payloads to unusual endpoints), unexpected child processes spawned by the Java/Tomcat stack, new admin account creation, and bulk script/policy deployments. Forward logs to your SIEM immediately.
4. Audit managed endpoint activity for post-compromise indicators — Review N-central-pushed script executions and software deployments from the past 30 days for anomalies. Check for unauthorized RMM tool installations (the Sophos report documents attackers deploying secondary RMM tools via compromised N-central).
5. Segment managed endpoints from N-central admin plane — Ensure N-central service accounts on managed endpoints have least-privilege access. Where possible, require MFA for administrative actions pushed via the RMM agent. This limits blast radius if the server is compromised.

Run this script on the N-central server itself (Linux appliance) as root or the N-central service account. Execute with: sudo bash check_cve_2026_86218.sh. It checks the installed build version against the patched version.

#!/bin/bash
# CVE-2026-86218 Patch Verification for N-able N-central
# Run on the N-central server as root
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

PATCHED_BUILD="2026.3.1.14"

# Attempt to read N-central version from known locations
VERSION_FILE="/opt/nable/nccentral/version.txt"
ALT_VERSION_FILE="/opt/nable/var/nccentral/version.properties"

get_version() {
    if [ -f "$VERSION_FILE" ]; then
        cat "$VERSION_FILE" | grep -oP '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1
    elif [ -f "$ALT_VERSION_FILE" ]; then
        grep 'version=' "$ALT_VERSION_FILE" | grep -oP '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1
    else
        echo ""
    fi
}

# Compare version strings numerically
version_gte() {
    local IFS=.
    local i ver1=($1) ver2=($2)
    for ((i=0; i<${#ver2[@]}; i++)); do
        if ((10#${ver1[i]:-0} > 10#${ver2[i]:-0})); then
            return 0
        fi
        if ((10#${ver1[i]:-0} < 10#${ver2[i]:-0})); then
            return 1
        fi
    done
    return 0
}

CURRENT_VERSION=$(get_version)

if [ -z "$CURRENT_VERSION" ]; then
    # Try systemctl/process check as fallback
    if ! pgrep -f 'nccentral\|nable' > /dev/null 2>&1; then
        echo "UNKNOWN - N-central does not appear to be installed on this host."
        exit 2
    fi
    echo "UNKNOWN - N-central detected but unable to determine version. Check manually."
    exit 2
fi

echo "Detected N-central version: $CURRENT_VERSION"
echo "Patched version (CVE-2026-86218): $PATCHED_BUILD"

if version_gte "$CURRENT_VERSION" "$PATCHED_BUILD"; then
    echo "PATCHED - N-central $CURRENT_VERSION >= $PATCHED_BUILD. CVE-2026-86218 is remediated."
    exit 0
else
    echo "VULNERABLE - N-central $CURRENT_VERSION is below $PATCHED_BUILD. Apply Hotfix 4 immediately."
    exit 1
fi

Sources

1. Huntress — N-able N-central Vulnerability and Active Exploitation
2. N-able Status — N-central 2026.3 Hotfix 4 Advisory
3. Horizon3 — N-able N-central: From N-days to 0-days
4. GBHackers — Critical N-able N-central Flaw Enables Pre-Auth RCE
5. BleepingComputer — CISA warns of N-able N-central flaws exploited in zero-day attacks
6. Sophos — N-able N-central exploitation results in RMM tool deployment
7. CyberPress — Critical N-able N-central Flaw Enables Pre-Auth RCE
8. Rapid7 — CVE-2026-18577 N-able N-central Authentication Bypass