NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

N-able N-central code-execution flaw CVE-2026-86218 exploited; Hotfix 4 fixes it

Attackers can run code without logging into vulnerable N-able N-central servers used by IT providers. Install 2026.3 Hotfix 4 (2026.3.1.14) and investigate suspicious accounts and activity. N-able's hosted instances were already patched.

What to do

If an IT provider manages your family's or business's computers, ask whether it uses N-central and has installed 2026.3 Hotfix 4 (2026.3.1.14) or a later release. Ask it to review unexpected accounts and suspicious activity as well as patching the server. N-able says its own hosted instances were already patched, and this fix does not require updating the agents on managed computers.

What’s happening

CVE-2026-86218 is a critical static code injection flaw in N-able N-central, software IT teams and service providers use to manage computers remotely. It affects versions before 2026.3.1.14 and allows an attacker to run code on the server without logging in. A compromised management server can put the computers it manages at risk. N-able released 2026.3 Hotfix 4 on 6 September; Hotfix 3 does not fix this separate vulnerability. N-able said its hosted instances were already patched, while self-hosted customers needed to upgrade. Early vendor notices disagreed about exploitation. CISA listed the flaw as exploited on 8 September, and N-able clarified on 9 September that it had observed a handful of successful attacks against customers. As at 3 November, a fix is available, but patch availability does not establish that previously compromised environments have been cleared.

What
Flaw
Affects
N-able N-central remote monitoring and management server
Affected
N-able N-central versions before 2026.3.1.14, including 2026.3 Hotfix 3 (2026.3.1.13)
Fixed in
N-central 2026.3 Hotfix 4 (2026.3.1.14)
N-able-hosted N-central (NCOD): patches already applied by N-able
CVE
CVE-2026-86218
Since
6 Sept 2026
Closed
9 Sept 2026

Timeline

  1. Vendor revised

    N-able clarified that the initial exploitation report came from an independent researcher's own production environment. It subsequently observed a handful of successful attacks against customers and said it was investigating and helping customers reporting suspicious activity.

  2. CISA added

    CISA added CVE-2026-86218 to its Known Exploited Vulnerabilities catalogue, as recorded by the Canadian Centre for Cyber Security.

  3. Update

    The Hacker News documented conflicting N-able statements: its incident notice reported exploitation, while its release notes said production exploitation was unconfirmed. Huntress could not attribute a customer's September intrusion specifically to this flaw.

  4. New fixFixed

    N-able released N-central 2026.3 Hotfix 4, build 2026.3.1.14, for CVE-2026-86218. It said hosted instances were already patched; self-hosted customers needed to upgrade, including those on Hotfix 3.

Sources

  1. N-central 2026.3 Hotfix 4 – CVE-2026-86218N-able · 6 Sept 2026
  2. 2026.3 HF4 Release NotesN-able · 5 Sept 2026
  3. N-central Security Update – Take Action to Apply 2026.3 HF4N-able · 9 Sept 2026
  4. Critical N-able N-central Vulnerability and Active ExploitationHuntress · 6 Sept 2026
  5. N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE FlawThe Hacker News · 7 Sept 2026
  6. N-able security advisory (AV26-885) – Update 2Canadian Centre for Cyber Security · 9 Sept 2026
  7. CVE-2026-86218: N-able CVE record mirrored by OpenCVEOpenCVE · 8 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from September 2026 · JSON · RSS