SecurityOnlineDo Son
N-able N-central Flaw Exposes MSP Clients to Root-Level Attacks
Part of the CVE-2026-86218 story · since 7 Sep
- Mon 7 Sep, 10:13 UTC. The Hacker News, first report. N-able Warns of Unauthenticated RCE Flaw in N-central Servers. Cites a CVE in CISA KEV.
- Mon 7 Sep, 10:49 UTC. SecurityOnline, its first report on the story. N-able Patches N-central RCE Exploited Against MSPs. Cites a CVE in CISA KEV.
- Mon 7 Sep, 13:13 UTC. Infosecurity, its first report on the story. N-able Patches CVSS 10 N-central Flaw Enabling Pre-Auth RCE. Cites a CVE in CISA KEV.
- Tue 8 Sep, 11:01 UTC. SecurityWeek, its first report on the story. N-able Patches Exploited N-central Zero-Day Allowing Server Takeover. Cites a CVE in CISA KEV.
- Tue 8 Sep, 21:01 UTC. CISA, its first report on the story. Attackers Exploit Critical N-able N-central Flaw Before Authentication. Cites a CVE in CISA KEV.
- Wed 9 Sep, 05:13 UTC. The Hacker News. CISA Warns Attackers Are Exploiting N-able N-central Flaw. Cites a CVE in CISA KEV.
- Wed 9 Sep, 05:50 UTC. SecurityOnline. CVE-2026-41870: Unauthenticated RCE in Apache Nutch. Cites a CVE in CISA KEV.
- Thu 10 Sep, 08:37 UTC. Security Affairs, its first report on the story. CISA Warns of Exploited Magento Flaw Enabling Remote Code Execution. Cites a CVE in CISA KEV.
- Mon 14 Sep, 03:11 UTC. SecurityOnline. N-able N-central Flaw Exposes MSP Clients to Root-Level Attacks. Cites a CVE in CISA KEV. This article, 9th of 10.
- Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
N-able N-central is affected by a critical static code injection vulnerability, tracked as CVE-2026-86218, which allows unauthenticated remote attackers to execute arbitrary operating-system commands with root privileges. The flaw has a CVSS v4 score of 10.0 and affects on-premises N-central installations earlier than 2026.3.1.14, including systems running Hotfix 3.
N-able has said the vulnerability has been observed being exploited in the wild, although the article provides no details about the victims or attack campaigns.
The issue arises when the application processes crafted network requests containing untrusted input without adequate validation. A functional Metasploit exploit module was also publicly released by Rapid7 researcher Stephen Fewer, potentially lowering the barrier to exploitation. The article says the vulnerability creates supply-chain risks for managed service providers because a compromised N-central server could provide access to connected client environments. CISA has added CVE-2026-86218 to its Known Exploited Vulnerabilities catalogue.
Administrators should upgrade on-premises servers to N-central 2026.3.1.14 immediately. N-able says hosted cloud instances have already been patched and endpoint agents do not require updates. Where immediate patching is not possible, Huntress recommends isolating the management web console behind a VPN or enforcing strict IP allow-listing. Organisations should also check user directories for unauthorised accounts that may have been created during an intrusion.
How the story developed
10 articles from 6 outlets since 7 Sep. Quiet since 14 Sep. This was the 9th report, 7 days after the first.
- Mon 7 Sep, 10:13 UTC. The Hacker News, first report. N-able Warns of Unauthenticated RCE Flaw in N-central Servers. Cites a CVE in CISA KEV.
- Mon 7 Sep, 10:49 UTC. SecurityOnline, its first report on the story. N-able Patches N-central RCE Exploited Against MSPs. Cites a CVE in CISA KEV.
- Mon 7 Sep, 13:13 UTC. Infosecurity, its first report on the story. N-able Patches CVSS 10 N-central Flaw Enabling Pre-Auth RCE. Cites a CVE in CISA KEV.
- Tue 8 Sep, 11:01 UTC. SecurityWeek, its first report on the story. N-able Patches Exploited N-central Zero-Day Allowing Server Takeover. Cites a CVE in CISA KEV.
- Tue 8 Sep, 21:01 UTC. CISA, its first report on the story. Attackers Exploit Critical N-able N-central Flaw Before Authentication. Cites a CVE in CISA KEV.
- Wed 9 Sep, 05:13 UTC. The Hacker News. CISA Warns Attackers Are Exploiting N-able N-central Flaw. Cites a CVE in CISA KEV.
- Wed 9 Sep, 05:50 UTC. SecurityOnline. CVE-2026-41870: Unauthenticated RCE in Apache Nutch. Cites a CVE in CISA KEV.
- Thu 10 Sep, 08:37 UTC. Security Affairs, its first report on the story. CISA Warns of Exploited Magento Flaw Enabling Remote Code Execution. Cites a CVE in CISA KEV.
- Mon 14 Sep, 03:11 UTC. SecurityOnline. N-able N-central Flaw Exposes MSP Clients to Root-Level Attacks. Cites a CVE in CISA KEV. This article, 9th of 10.
- Mon 14 Sep, 03:11 UTC. SecurityOnline. CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 10 articles as a listHide the list
- Mon 7 SepDay 03
- N-able Warns of Unauthenticated RCE Flaw in N-central Servers10:13 · The Hacker News · First report · Exploited CVE · Known exploited CVE
- N-able Patches CVSS 10 N-central Flaw Enabling Pre-Auth RCE13:13 · Infosecurity · Known exploited CVE
- Tue 8 SepDay 12
- N-able Patches Exploited N-central Zero-Day Allowing Server Takeover11:01 · SecurityWeek · Known exploited CVE
- Attackers Exploit Critical N-able N-central Flaw Before Authentication21:01 · CISA · official · CISA alert · Known exploited CVE
- Wed 9 SepDay 22
- CISA Warns Attackers Are Exploiting N-able N-central Flaw05:13 · The Hacker News · Known exploited CVE
- Thu 10 SepDay 31
- CISA Warns of Exploited Magento Flaw Enabling Remote Code Execution08:37 · Security Affairs · Known exploited CVE
Quiet for 4 days
Mon 14 SepDay 72- N-able N-central Flaw Exposes MSP Clients to Root-Level Attacks03:11 · SecurityOnline · Picked up again · Known exploited CVE · This article, 9th of 10
- CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flaws03:11 · SecurityOnline · Known exploited CVE