CVE-2026-86218 is a maximum-severity, unauthenticated, pre-authentication remote code execution vulnerability in N-able N-central, a widely-deployed remote monitoring and management (RMM) platform used globally by Managed Service Providers (MSPs) to centrally administer and support their downstream clients' IT infrastructure. Because a single compromised N-central instance can be leveraged by an attacker to reach every endpoint the operating MSP manages, this carries the same supply-chain-multiplier risk long associated with RMM platforms generally.

The following version(s) are affected:

N-able N-central (on-premises/self-hosted) prior to 2026.3.1.14 – (Affected)
N-central 2026.3.1.14 (Hotfix 4) and later is already applied automatically to all cloud-hosted (NCOD) instances; on-premises deployments require a manual upgrade – (Not affected, patched)

Typical attack flow:

1. Reach the exposed N-central management interface — N-central's web-based administration interface is typically exposed to the internet so MSP staff can manage it remotely; because this flaw requires no authentication whatsoever, any attacker able to reach that interface over the network can attempt exploitation directly.
2. Inject and trigger execution of malicious statically-saved code — The attacker submits crafted input that N-central improperly neutralizes before saving it as part of its own statically-saved configuration/code artifacts; when that saved content is later processed, the injected code executes with the platform's own privileges, giving the attacker code execution on the N-central server itself.

Attack vectors:

• A network-based, unauthenticated attack over HTTP/HTTPS against any internet-facing N-able N-central instance exposing its administration interface (CVSS AV:N/AC:L/AT:N/PR:N/UI:N) - no credentials, privileges, or user interaction of any kind are required.
• CERTVU treats this vulnerability as confirmed actively exploited in the wild.

Successful exploitation may allow attackers to:

• Achieve full, unauthenticated remote code execution on the N-central server itself, and because N-central is an RMM platform with a "Take Control" remote-access feature and stored access to every endpoint it manages.
• Create persistent unauthorized administrative accounts (observed in the wild using ".invalid" or manipulated, lookalike email addresses to evade casual review), abuse the platform's own Take Control remote-access feature to reach managed endpoints, and establish backdoor persistence such as an unauthorized Cloudflare tunnel connection.

CERTVU recommends the following:

1. Apply N-central Hotfix 4 Immediately

   Apply N-able N-central 2026.3.1.14 (Hotfix 4) immediately. This vulnerability is confirmed exploited in the wild. Apply Hotfix 4 to every on-premises/self-hosted N-central instance without delay (cloud-hosted NCOD instances have already been patched automatically by N-able), and confirm the installed build number directly rather than assuming the update has applied.

2. Review for Indicators of Compromise

   Review the environment for the indicators of compromise listed above before considering any internet-facing instance clean.

3. Rotate Credentials and Audit Accounts

   Rotate credentials and audit all administrative accounts after patching.

4. Treat as an MSP Supply-Chain Risk

   Treat this as a Managed Service Provider (MSP) supply-chain risk, not just a single-platform patch.

5. Monitor for Unauthorized Access Indicators

   Monitor for unauthorized Cloudflare tunnels, new administrative accounts, and Take Control.

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.