{"id":"nable-ncentral-code-injection-attacks-sep-2026","category":"patch","status":"closed","title":"N-able N-central code-execution flaw CVE-2026-86218 exploited; Hotfix 4 fixes it","tldr":"Attackers can run code without logging into vulnerable N-able N-central servers used by IT providers. Install 2026.3 Hotfix 4 (2026.3.1.14) and investigate suspicious accounts and activity. N-able's hosted instances were already patched.","summary":"CVE-2026-86218 is a critical static code injection flaw in N-able N-central, software IT teams and service providers use to manage computers remotely. It affects versions before 2026.3.1.14 and allows an attacker to run code on the server without logging in. A compromised management server can put the computers it manages at risk. N-able released 2026.3 Hotfix 4 on 6 September; Hotfix 3 does not fix this separate vulnerability. N-able said its hosted instances were already patched, while self-hosted customers needed to upgrade. Early vendor notices disagreed about exploitation. CISA listed the flaw as exploited on 8 September, and N-able clarified on 9 September that it had observed a handful of successful attacks against customers. As at 3 November, a fix is available, but patch availability does not establish that previously compromised environments have been cleared.","action":"If an IT provider manages your family's or business's computers, ask whether it uses N-central and has installed 2026.3 Hotfix 4 (2026.3.1.14) or a later release. Ask it to review unexpected accounts and suspicious activity as well as patching the server. N-able says its own hosted instances were already patched, and this fix does not require updating the agents on managed computers.","product":"N-able N-central remote monitoring and management server","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-86218"],"tags":["n-able","n-central","remote-management","code-injection","zero-day","actively-exploited"],"affected":["N-able N-central versions before 2026.3.1.14, including 2026.3 Hotfix 3 (2026.3.1.13)"],"fixed":["N-central 2026.3 Hotfix 4 (2026.3.1.14)","N-able-hosted N-central (NCOD): patches already applied by N-able"],"matches":[],"sources":[{"kind":"advisory","title":"N-central 2026.3 Hotfix 4 – CVE-2026-86218","url":"https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/","by":"N-able","date":"2026-09-06"},{"kind":"advisory","title":"2026.3 HF4 Release Notes","url":"https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF4_Release_Notes.htm","by":"N-able","date":"2026-09-05"},{"kind":"post","title":"N-central Security Update – Take Action to Apply 2026.3 HF4","url":"https://www.n-able.com/blog/n-central-security-hotfix-september-5-2026","by":"N-able","date":"2026-09-09"},{"kind":"research","title":"Critical N-able N-central Vulnerability and Active Exploitation","url":"https://www.huntress.com/blog/n-able-vulnerability-exploitation","by":"Huntress","date":"2026-09-06"},{"kind":"news","title":"N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw","url":"https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html","by":"The Hacker News","date":"2026-09-07"},{"kind":"advisory","title":"N-able security advisory (AV26-885) – Update 2","url":"https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","by":"Canadian Centre for Cyber Security","date":"2026-09-09"},{"kind":"advisory","title":"CVE-2026-86218: N-able CVE record mirrored by OpenCVE","url":"https://opencve.alliance.unm.edu/cve/CVE-2026-86218","by":"OpenCVE","date":"2026-09-08"}],"started":"2026-09-06","closed":"2026-09-09","created":"2026-11-03T22:13:38.787Z","updated":"2026-11-03T22:13:38.787Z","cve_notes":[{"cve":"CVE-2026-86218","name":"Static code injection in N-able N-central","what":"A static code injection flaw in the N-central server allows a remote attacker to run code without logging in.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-09-09T13:49Z","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"N-able clarified that the initial exploitation report came from an independent researcher's own production environment. It subsequently observed a handful of successful attacks against customers and said it was investigating and helping customers reporting suspicious activity.","url":"https://www.n-able.com/blog/n-central-security-hotfix-september-5-2026","by":"N-able","patch":null},{"at":"2026-09-08","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-86218 to its Known Exploited Vulnerabilities catalogue, as recorded by the Canadian Centre for Cyber Security.","url":"https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-09-07","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"The Hacker News documented conflicting N-able statements: its incident notice reported exploitation, while its release notes said production exploitation was unconfirmed. Huntress could not attribute a customer's September intrusion specifically to this flaw.","url":"https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html","by":"The Hacker News","patch":null},{"at":"2026-09-06","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"N-able released N-central 2026.3 Hotfix 4, build 2026.3.1.14, for CVE-2026-86218. It said hosted instances were already patched; self-hosted customers needed to upgrade, including those on Hotfix 3.","url":"https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/","by":"N-able","patch":"patched"}],"url":"https://hard.fyi/live/nable-ncentral-code-injection-attacks-sep-2026/","json":"https://hard.fyi/api/live?id=nable-ncentral-code-injection-attacks-sep-2026"}