CVE-2026-86218: N-able N-central pre-auth remote code execution via static code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityPre-auth network-reachable remote code execution with a CVSS 4.0 score of 10.0 and confirmed exploitation via CISA KEV.

What it is

N-central contains a static code injection flaw (CWE-96) that allows remote code execution before authentication. The record states the issue affects N-central before 2026.3.1.14, and CISA added it to the Known Exploited Vulnerabilities catalog, so it is being exploited in the wild. Because it is pre-auth and network reachable, any exposed instance is at immediate risk.

Impact

An unauthenticated attacker can execute arbitrary code on the N-central server, gaining full control of the host and any managed endpoints or credentials it holds. CVSS 4.0 scores it 10.0 with high confidentiality, integrity and availability impact across the vulnerable and subsequent systems.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector (AV:N/PR:N/UI:N). The description does not specify the exact endpoint or interface, so defenders should treat all network-exposed N-central services as in scope.

Exploitation

CISA added this to the KEV catalog on 2026-09-08 with a remediation due date of 2026-09-11, indicating known exploitation. EPSS is low (0.00744, 53rd percentile), so the KEV listing is the stronger signal. No ransomware campaign use is documented.

What to do

• Upgrade N-central to 2026.3.1.14 or later immediately, per the vendor advisory.
• If patching cannot be completed before the CISA due date, remove internet exposure of N-central or discontinue use until mitigations are applied.
• Apply any vendor-supplied mitigations or workarounds in the N-able security advisory.
• Restrict management and agent-facing ports to trusted networks and place N-central behind a hardened reverse proxy or VPN.
• Rotate credentials and certificates stored or managed by N-central after remediation, assuming possible compromise.

Detection

• Review N-central and web server logs for unexpected POST or request patterns to application endpoints from unauthenticated sources.
• Hunt for anomalous child processes spawned by the N-central service (web/app server, Java, or IIS worker processes).
• Monitor for new or modified files in N-central web-accessible directories and for outbound connections from the N-central host.
• Check for unexpected scheduled tasks, new local accounts, or persistence mechanisms on the N-central server.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.