Critical N-able N-central RCE Flaw Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution (RCE) vulnerability in N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog. Rated with a maximum CVSS score of 10.0, CVE-2026-86218 allows unauthenticated attackers to execute arbitrary code on affected systems.

This move by CISA underscores the severity and active exploitation of the flaw. Federal Civilian Executive Branch (FCEB) agencies have been directed to apply necessary updates by September 11, 2026. Organizations relying on N-able N-central for IT management should treat this as a high-priority security issue.

Vulnerability Details

• CVE-2026-86218 is a pre-authentication remote code execution vulnerability in N-able N-central.
• It carries a critical CVSS v3 score of 10.0, indicating the highest level of severity.
• The flaw allows unauthenticated attackers to remotely execute arbitrary code on vulnerable systems.
• No user interaction or additional privileges are required for exploitation.

Impact and Response

• CISA has added the vulnerability to its KEV catalog, signaling known active exploitation.
• Federal agencies must remediate the issue by September 11, 2026.
• N-able has released patches to address the vulnerability; customers should update immediately.
• Organizations outside the federal sector are also strongly advised to patch due to active exploitation.

Sources

• N-able N-central Pre-Auth RCE Flaw Exploited in the Wild