N-able has disclosed a critical vulnerability in its N-central IT operations management platform used for remote monitoring of servers and network devices. The flaw, identified as CVE-2026-86218, permits unauthenticated remote code execution on the N-central server and carries the highest possible CVSSv4.0 base score of 10.0, classifying it as Critical.
The vendor published its security advisory on September 5, 2026. The issue was reported through N-able’s coordinated vulnerability disclosure program. In response, the company released N-central 2026.3 Hotfix 4 (2026.3.1.14), which patches the vulnerability. This update supersedes the previously issued Hotfix 3 that addressed CVE-2026-86206 and CVE-2026-86207.
While agent upgrades are not strictly required to mitigate CVE-2026-86218, N-able strongly recommends updating all components to the latest versions. At the time of initial disclosure, no exploitation had been observed; however, the advisory was updated on September 6 to confirm that the vulnerability is being actively exploited in the wild.
Customers are advised to check for signs of compromise, including unexpected account creation and scanning activity originating from specific IP addresses. N-able continues to urge immediate application of the hotfix and ongoing monitoring of environments.
