N-central CVE-2026-86218

Exploitation requires network reachability to the N-central server's affected pre-authentication interface and a running instance on any version before 2026.3.1.14; per the CVSS 4.0 vector (PR:N/UI:N/AT:N), no authentication, user interaction, or special attack prerequisites are needed against a default deployment. The primary limiting factor is network exposure - instances that are not reachable from the attacker's network position (e.g. behind a VPN or IP allowlist) are not remotely exploitable - and the requirement that the instance be at a vulnerable pre-2026.3.1.14 build.

This is a top-priority, drop-everything issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and full high impact to both the vulnerable system and subsequent systems (VC:H/VI:H/VA:H, SC:H/SI:H/SA:H) for a maximal 10.0 score - signals that are internally consistent with a pre-auth RCE. EPSS and KEV data were not provided, so exploitation-in-the-wild cannot be asserted; the absence of a KEV listing or public POC lowers the immediate mass-exploitation signal but does not reduce urgency, since RMM platforms are prized supply-chain targets and any mid-sized operator running an internet-exposed N-central instance should treat this as urgent. The only material uncertainty is that all severity data originates from a single vendor advisory with no independent NVD enrichment, POC, or telemetry to corroborate the score.

An attacker who can reach an internet-exposed N-central server sends a crafted request to the vulnerable pre-auth endpoint, injecting directives that are stored and then executed as code on the server, gaining remote code execution with no credentials. From that foothold on the MSP management plane, the attacker can pivot to push malicious scripts or software to every managed endpoint. No public POC has been identified, but the low attack complexity makes exploit development straightforward once the flaw is understood.