TL;DR A critical static code injection flaw allows unauthenticated remote attackers to execute arbitrary commands on N-central servers. The vulnerability has seen active exploitation in the wild across multiple target environments. System administrators must apply the latest hotfix immediately or restrict internet access to their management consoles. Why This Threat Matters Industry estimates suggest thousands of managed service providers deploy N-central to manage corporate client networks.

A clandestine pathway into the N-central server, bypassing all credential requirements, has once again been discovered, and this time, the vulnerability commands the absolute maximum severity rating. N-able has issued a dire warning regarding CVE-2026-86218, a critical flaw permitting pre-authentication code execution, subsequently releasing N-central 2026.3 HF4 to mitigate the threat. The company has explicitly implored administrators to audit their user registries and hunt for any unfamiliar accounts.

N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform.

Rapid7 researchers discovered two critical authentication bypass vulnerabilities in N-able N-Central RMM platform. When chained together, CVE-2026-86206 and CVE-2026-86207 allow unauthenticated attackers to create System administrator accounts. Both vulnerabilities involve Envoy proxy path interpretation differences and two-factor authentication logic flaws.

The N-central urgent patch series received another continuation just one day after the previous update. Specifically, N-able resolved CVE-2026-86218. This flaw allows remote code execution on the server before authentication. Consequently, the vulnerability earned a maximum CVSS 4.0 score of 10.0. The problem affects all N-central versions prior to 2026.3.1.14. Attackers merely need network access. Furthermore, they require no user account or interaction.

CISA has added CVE-2026-86218, a critical static code injection flaw in N-able N-central, to its KEV catalog and ordered FCEB agencies to patch it by September 11, 2026. N-able said the issue has been exploited in the wild, while Huntress is investigating a compromise of a fully patched N-central environment and...

{{rh9e7yNRO}}

Daily Recap, Attackers are actively leveraging multiple critical vulnerabilities, including N-able N-central CVE-2026-86218, an Adobe Commerce zero-day, and new MikroTik RouterOS bugs, to achieve RCE, plant backdoors, and hijack routers. Meanwhile, ConnectWise ScreenConnect is facing a worm-like file-transfer campaign, researchers revealed Nightmare Eclipse targeting CrowdStrike, Nvidia, and Avast, and Trezor reported breach impact affecting 81,000 customers. #CVE-2026-86218 #N-able #N-central #AdobeCommerce #MikroTik #RouterOS #ConnectWise #ScreenConnect #NightmareEclipse #CrowdStrike #Nvidia #Avast #Trezor #CCQ #SEP-2026

{{rh9e7yNRO}}

N-able released an emergency hotfix for CVE-2026-86218, a critical pre-authenticated remote code execution flaw in N-central used by MSPs. The company urged on-premises customers to upgrade immediately, while reports also suggested the vulnerability may have been exploited in the wild. #N-able #N-central #CVE-2026-86218 #Huntress

TL;DR On September 6, 2026, N-able released an urgent security update fixing an actively exploited zero-day flaw. The critical N-central vulnerability allows remote unauthenticated attackers to execute arbitrary code with root privileges. Consequently, administrators must apply Hotfix 4 immediately to protect on-premises appliances from complete system takeover. Why It Matters Massive Attack Surface for Service Providers Managed service providers run N-central software to control thousands of client computers worldwide.

N-able has issued Hotfix 4 for N-central to patch CVE-2026-86218, a maximum-severity pre-authentication remote code execution flaw affecting all on-premises builds before 2026.3.1.14. The company’s notices conflict on exploitation status, with one saying the issue has been observed in the wild while other release notes say there are no confirmations of...

N-able shipped an emergency hotfix for a maximum-severity flaw in its N-central platform on September 6, 2026. The N-able N-central vulnerability, CVE-2026-86218, is a pre-auth remote code execution zero-day rated a perfect 10.0 CVSS. N-able's incident notice says the flaw has been observed exploited in the wild. Why this matters N-central is a remote monitoring and management (RMM) platform used by managed service providers.

N-able has issued an emergency hotfix for CVE-2026-86218, a maximum-severity RCE flaw in its N-central RMM platform that could let unauthenticated attackers run malicious code on exposed systems. Shadowserver reports nearly 1,500 internet-facing N-central servers, while Huntress says on-premises customers should move to N-central 2026.3 HF4 immediately because HF3 remains vulnerable. #Ncentral #CVE202686218 #Nable #ShadowserverFoundation #Huntress

CVE-2026-86218 is a critical CVSS 10.0 pre-authentication RCE in N-able N-central already observed in real-world exploitation. On-premise customers must install N-central 2026.3 HF4 immediately.

Versions of N-central released before 2026.3.1.14 can be tricked into executing malicious commands without any user authentication.

Microsoft says the threat actor Storm-1175, previously linked to Medusa ransomware, is now deploying a new ransomware strain called StormEncryptor after likely exploiting CVE-2026-18577 in N-central. The malware appends the .encrypted extension, drops a ransom note named !!!README_FIRST!!!.txt, and threatens to leak stolen data if victims do not pay within three days. #Storm-1175 #StormEncryptor #CVE-2026-18577 #N-central #Medusa

Microsoft says Storm-1175, a China-linked financially motivated threat actor, has switched from Medusa to a new ransomware strain called StormEncryptor. The campaign likely abuses a newly disclosed N-able N-central flaw for access, then uses tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz before quickly exfiltrating data and encrypting systems. #Storm-1175...

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs