A Zero-Day With a Perfect Danger Score Is Being Exploited in N-able's Remote Management Software

Key points

• CVE-2026-86218, a remote-code-execution flaw (meaning attackers can run any commands they like on an affected server without logging in first) in N-able's N-central platform, carries a maximum danger score of 10.0 out of 10.
• N-able confirmed on 6 September 2026 that CVE-2026-86218 is being actively exploited and is unrelated to two earlier flaws disclosed on 5 September.
• Hotfix 4 supersedes Hotfix 3 and is the only available fix; on-premises customers must download and apply it manually.
• Security firm Huntress discovered an exploit chain combining CVE-2026-86206 and CVE-2026-86207 after investigating a customer breach on 4 September.
• Businesses using on-premises N-central that haven't yet applied Hotfix 4 remain exposed to all three vulnerabilities.

What is N-central, and why does this matter to ordinary people?

N-central is software that IT service companies use to remotely log into and manage the computers of their business customers, from small shops to hospitals. Compromise it and an attacker holds a master key to every machine that service company manages.

That's an especially attractive target. An attacker who breaks into one N-central server can silently create administrator accounts, move through client networks, and plant malicious software, all without a customer ever receiving a suspicious email or clicking a bad link.

How did this unfold?

The trouble started on 4 September, when Huntress began investigating a breach at a customer whose N-central server was fully patched at the time. The firm identified two flaws, CVE-2026-86206 and CVE-2026-86207, that together let attackers bypass login controls and create unauthorised administrator accounts. N-able issued Hotfix 3 (build 2026.3.1.13) on 5 September to address those bugs.

Then came 6 September. N-able disclosed CVE-2026-86218: a pre-authentication remote code execution flaw, meaning no username or password required. Connect to an exposed server, take full control. N-able confirmed active exploitation. We first reported this flaw on 7 September, when nearly 1,500 N-central servers were visible on the public internet.

Hotfix 4 supersedes Hotfix 3. Any system updated only to Hotfix 3 remains exposed to CVE-2026-86218.

What should businesses using N-central do right now?

Apply Hotfix 4 immediately. That's the single most important step.

For companies hosting N-central themselves, N-able hasn't pushed the fix automatically. Administrators must download and install it manually via N-able's support portal. Cloud-hosted instances have already received mitigations directly from N-able.

Huntress also recommends restricting access to the N-central login screen to known office IP addresses, or routing it through a VPN (a private encrypted tunnel that keeps the login page off the public internet). That removes a large portion of risk even before patching is complete.

Finally, Huntress advises reviewing recently created user accounts for suspicious naming patterns, particularly email addresses with ".invalid" appended, and checking server logs for unusual requests to internal programming interfaces. Because historical logs on many systems are limited, Huntress can't say with certainty which flaw was used in the 4 September breach. The pattern is harder to detect than earlier N-able intrusions: defenders can't simply flag suspicious remote-control sessions and call it done.

CSO Online first reported the details of Huntress's exploit-chain findings.