Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able’s incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed.
N-able has released its fourth hotfix in five weeks for the N-central remote monitoring and management (RMM) platform, this time for a maximum-severity vulnerability that could allow remote code execution on the N-central server without authentication.
The company’s own communications disagree on whether the flaw has already been exploited.
The vulnerability, tracked as CVE-2026-86218, carries a CVSS 4.0 score of 10.0, assigned by N-able as the CVE Numbering Authority, and is classed as a static code injection weakness (CWE-96).
It affects every N-central build before 2026.3.1.14, the build shipped as 2026.3 Hotfix 4 in the early hours of September 6 (UTC). That includes servers already updated to Hotfix 3 (2026.3.1.13), which N-able had published a little over eight hours earlier for two flaws that it says are unrelated to the new one.
N-able said hosted N-central (NCOD) instances have already been patched. On-premises customers are told to upgrade to 2026.3.1.14 immediately; the release notes list direct upgrade paths from 2025.4, 2026.1, 2026.2, 2026.3, and the 2026.3.1 hotfixes, and say agents do not need to be upgraded to be protected from this CVE.
The release notes, status post, and incident notice contain no indicators of compromise, no interim mitigation, and no detection guidance beyond a recommendation to audit N-central user accounts for unexpected users.
Huntress, which has been tracking attacks on N-central since August, has advised administrators to restrict inbound access to the console with IP allowlisting or a VPN and, where a server is still reachable from the internet, to consider taking it offline until the hotfix is applied.
On the question of exploitation, N-able’s channels diverge. The Hotfix 4 release notes and status post state that a third party responsibly disclosed the vulnerability through the company’s security disclosure program and that N-able has “no confirmations that this vulnerability has been exploited in production environments.”
The same release notes on N-able’s documentation site also describe it as a “critical zero-day vulnerability,” a term N-able does not define.
N-able’s incident notice on its uptime status page goes further. It says a third, independent security researcher alerted the company to a new vulnerability unrelated to the previously disclosed CVEs and that, unlike those, the newly identified flaw “has been observed being exploited in the wild.”
The notice does not say who observed the exploitation, where, or when, and N-able has not attributed the activity to any actor. As of September 7, the incident was still listed as open on N-able’s status page, as mirrored by the status-page aggregator IsDown.
The Hacker News has reached out to N-able for clarification on which statement is current and what evidence of exploitation the company holds.
Huntress said it cannot settle the question from its own data. The company began investigating on September 4 after a customer’s fully patched N-central production environment was compromised. It said it reproduced a proof-of-concept exploit chain against build 2026.3.1.10 that may use one or both of the two flaws later fixed in Hotfix 3, but the appliance’s logs had already rotated, leaving it “unable to say whether this new CVE was the vulnerability exploited” in that intrusion.
The hotfix is the fourth N-able has issued for the 2026.3 line since August 2 and covers the third distinct set of vulnerabilities:
- Hotfix 1 (2026.3.1.7), August 2 — CVE-2026-18577, an incomplete fix for CVE-2026-18556 that still allowed authentication bypass and account takeover; exploited in the wild
- Hotfix 2 (2026.3.1.10), August 6 — additional hardening for a related attack path
- Hotfix 3 (2026.3.1.13), September 5 — CVE-2026-86206, unauthorized access to internal APIs through the access control filter, and CVE-2026-86207, an authentication bypass in internal-only APIs
- Hotfix 4 (2026.3.1.14), September 6 — CVE-2026-86218, pre-authentication remote code execution
N-able described the two Hotfix 3 flaws as “high-CVSS-rated” vulnerabilities that could allow an unauthorized party to bypass authentication controls and gain full access to the platform.
Its own CVE records score CVE-2026-86207 at 7.7 (High) and CVE-2026-86206 at 6.9 (Medium). The company said it had no confirmation that either had been exploited in production environments.
The August hotfixes followed an intrusion N-able said it detected on July 31. Attackers used the authentication bypass to obtain administrative access to N-central servers, then used the platform’s Take Control feature to reach managed endpoints and register Cloudflare tunnel services on those devices, maintaining access after the route through N-central was cut off.
N-able said a limited number of customers were affected, its first fix proved incomplete, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities catalog. On August 10, the company said a full root-cause analysis was coming.
It is the second summer in a row that N-central has drawn in-the-wild attacks: in August 2025, two other flaws in the product, CVE-2025-8875 and CVE-2025-8876, were added to CISA’s catalog the same day N-able released fixes for them.
