CVE-2026-86218
N-able N-central Static Code Injection Vulnerability
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Deadline for federal agencies: 2026-09-11.
10 articles across 6 outlets · first covered Sep 7, 2026 · latest Sep 14, 2026
Coverage timeline
-
CISA Tracks Exploitation of Critical N-central, GitLab and MikroTik Flawssecurityonline.info · Sep 14, 2026
-
N-able N-central Flaw Exposes MSP Clients to Root-Level Attackssecurityonline.info · Sep 14, 2026
-
CISA Warns of Exploited Magento Flaw Enabling Remote Code Executionsecurityaffairs.com · Sep 10, 2026
-
CVE-2026-41870: Unauthenticated RCE in Apache Nutchsecurityonline.info · Sep 9, 2026
-
CISA Warns Attackers Are Exploiting N-able N-central Flawthehackernews.com · Sep 9, 2026
-
Attackers Exploit Critical N-able N-central Flaw Before Authenticationcisa.gov · Sep 8, 2026
-
N-able Patches Exploited N-central Zero-Day Allowing Server Takeoverwww.securityweek.com · Sep 8, 2026
-
N-able Patches CVSS 10 N-central Flaw Enabling Pre-Auth RCEwww.infosecurity-magazine.com · Sep 7, 2026
-
N-able Patches N-central RCE Exploited Against MSPssecurityonline.info · Sep 7, 2026
-
N-able Warns of Unauthenticated RCE Flaw in N-central Serversthehackernews.com · Sep 7, 2026