CVE Tools
Track your stack

N-able N-central Pre-Auth RCE Flaw Exploited in the Wild

The Hacker NewsBy The Hacker News

Reported exploitedN-central

Our summary

CISA has added CVE-2026-86218 to its Known Exploited Vulnerabilities catalog, mandating that federal agencies patch N-able N-central by September 11, 2026. This maximum-severity flaw (CVSS 10.0) enables pre-authentication remote code execution via static code injection. The vendor released a fix in N-central 2026.3 Hotfix 4 on September 5, 2026, following reports of active exploitation and customer compromises investigated by Huntress.

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker News⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and MoreCVE-2026-86206, CVE-2026-86207 +1
  2. Help Net SecurityN-able patches critical N-central zero-day exploited in the wild (CVE-2026-86218)CVE-2026-86206, CVE-2026-86207 +1
  3. The Hacker NewsN-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE FlawCVE-2026-86206, CVE-2026-86207 +1
  4. BleepingComputerN-able patches max severity N-central flaw amid ongoing attacksCVE-2026-86206, CVE-2026-86207 +1
  5. Help Net SecurityWeek in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploitedCVE-2026-86218

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store