Which versions of N-central are affected by CVE-2026-86218?

N-able N-central versions prior to 2026.3.1.14 are vulnerable to unauthenticated remote code execution (CVSS 10.0) with network-accessible attack surface, meaning any attacker can directly compromise…. A patch is available.

Is there a public PoC exploit available for CVE-2026-86218?

Yes, a public proof-of-concept exploit is available for CVE-2026-86218. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-86218?

Within 24 hours: Inventory all N-able N-central deployments, document running versions, and immediately implement network segmentation to restrict management server access to trusted administrative networks only-remove or disable any internet-facing exposure. Within 7 days: Deploy intrusion detection rules targeting N-central exploit attempts; contact N-able support for interim mitigation guidance and confirmed patch release timeline; review server access logs for indicators of compromise or suspicious administrative activity. Within 30 days: Apply N-able N-central version 2026.3.1.14 or later to all management servers immediately upon release; conduct a post-remediation security audit of managed endpoints to validate no unauthorized changes or persistence mechanisms were installed during the exposure window.

N-central CVE-2026-86218

Q: What is the CVSS score of CVE-2026-86218?

CVE-2026-86218 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-72041 CRITICAL

Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') (CWE-96)

2026-09-06 N-able

GHSA-5f24-g9g9-m3v8

RCE N Central N Able

10.0

CVSS 4.0 · Vendor: N-able

Severity by source

Vendor (N-able) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Pre-auth network RCE with no user interaction gives AV:N/AC:L/PR:N/UI:N; RMM management-plane code exec reaching downstream systems justifies S:C and full C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (N-able).

CVSS VectorVendor: N-able

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Threat Model Generated

Sep 08, 2026 - 19:41 vuln.today

Added to CISA KEV

Sep 08, 2026 - 19:05 CISA

POC Analysis Generated

Sep 07, 2026 - 15:30 vuln.today

Patch available

Sep 06, 2026 - 04:16 EUVD

Analysis Generated

Sep 06, 2026 - 02:42 vuln.today

CVE Published

Sep 06, 2026 - 02:15 cve.org

CRITICAL 10.0

DescriptionCVE.org

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

Articles & Coverage 1

POC CVE-2026-86218: Pre-Authentication Remote Code Execution in N-central Sep 07, 2026

AnalysisAI

Pre-authentication remote code execution in N-able N-central before 2026.3.1.14 allows unauthenticated remote attackers to execute arbitrary code on the management server, per the vendor's own security advisory. Rated CVSS 4.0 10.0 with a full-impact vector including scope change, it targets a platform that centrally manages large fleets of downstream endpoints, making it an exceptionally high-value target. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network reachability to the N-central server's affected pre-authentication interface and a running instance on any version before 2026.3.1.14; per the CVSS 4.0 vector (PR:N/UI:N/AT:N), no authentication, user interaction, or special attack prerequisites are needed against a default deployment. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a top-priority, drop-everything issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to N-central 2026.3.1.14 or later immediately - this is the vendor-released patch and the only complete fix (see https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all N-able N-central deployments, document running versions, and immediately implement network segmentation to restrict management server access to trusted administrative networks only-remove or disable any internet-facing exposure. …

Threat intelligence, references, and detailed analysis are available after sign-in.