CVE-2026-86218
Critical pre-authentication Remote Code Execution flaw in N-able's N-central server.
CISA declared CVE-2026-86218 exploited on 8 September 2026 and gave federal agencies until 11 September to patch N-central, two days after N-able shipped a hotfix and said it had no confirmed attacks.
Last refreshed: 12 October 2026
Why did CISA call this N-central flaw exploited when N-able did not?
Timeline for CVE-2026-86218
Mentioned in: CISA flags N-central flaw as exploited
Cybersecurity: Threats and DefencesBackground
CVE-2026-86218 lets an outsider run code on an N-able N-central server without logging in. Managed service providers use N-central to administer their customers' computers, so one compromised server reaches every machine on a provider's books rather than a single network.
N-able's CVE record scores the flaw 10.0 under CVSS 4.0 and marks every N-central build earlier than 2026.3.1.14 as vulnerable. N-able issued two fixes on 5 and 6 September 2026; the second, Hotfix 4 for N-central 2026.3, closed this hole. N-able said at the time that it had "no confirmations" of exploitation and that hosted instances were already patched.
CISA disagreed with that picture on 8 September, adding the bug to its Known Exploited Vulnerabilities catalogue with a three-day federal deadline.