N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform.
IT departments and managed service providers (MSPs) use the N-central platform to monitor, manage, and maintain client networks and devices from a centralized web-based console.
Tracked as CVE-2026-86218, this RCE vulnerability allows threat actors without privileges to execute malicious code on unpatched N-central instances exposed online in low-complexity attacks.
N-able addressed the flaw on Saturday by releasing N-central 2026.3 Hotfix 4 and urging customers to patch as soon as possible.
“At this time, we have no confirmations that this vulnerability has been exploited in production environments, but unpatched systems remain at risk,” the company said.
“Customers running on-premises N-central deployments should upgrade to N-central 2026.3 HF4 immediately to protect their environment.”
Internet security nonprofit Shadowserver Foundation now tracks nearly 1,500 N-central servers exposed online, most of them located in the United States and Europe.
Evidence of active exploitation
While N-able has yet to confirm that the CVE-2026-86218 flaw is being targeted, cybersecurity company Huntress has flagged it as a potential zero-day, along with two high-severity vulnerabilities (tracked as CVE-2026-86206 and CVE-2026-86207, and also patched over the weekend) that can allow attackers to bypass authentication and gain full access to the vulnerable N-central platform.
“In our 9/5/26 update [..], we had said we could not rule out whether the two previous vulnerabilities released (CVE-2026-86206 and CVE-2026-86207) were the ones that were exploited in the instance seen in the patched production environment of one of our customers,” Huntress said.
“Because logs on the compromised N-central server had already rotated, we are also unable to say whether this new CVE was the vulnerability exploited in that case.”
“On-premises N-central users must apply HF4 immediately, as systems running HF3 remain vulnerable to this newly disclosed flaw,” Huntress warned.
One year ago, N-able released security updates for two N-central vulnerabilities (CVE-2025-8875 and CVE-2025-8876) that attackers were exploiting in the wild.
Days later, Shadowserver found that 880 N-central servers were still vulnerable to attacks exploiting the two security flaws even after CISA ordered federal agencies to patch their systems within a week and urged all security teams to also prioritize securing their systems against ongoing attacks.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
