A Zero-Day With a Perfect Danger Score Is Being Exploited in N-able's Remote Management Software

Key points

• CVE-2026-86218, a remote-code-execution flaw (meaning attackers can run any commands they like on an affected server without logging in first) in N-able's N-central platform, carries a maximum danger score of 10.0 out of 10.
• N-able confirmed on 6 September 2026 that CVE-2026-86218 is being actively exploited and is unrelated to two earlier flaws disclosed on 5 September.
• Hotfix 4 (build 2026.3.1.13 superseded) replaces Hotfix 3 and is the only available fix; on-premises customers must download and apply it manually.
• Security firm Huntress discovered an exploit chain combining CVE-2026-86206 and CVE-2026-86207 after investigating a customer breach on 4 September.
• Businesses using on-premises N-central that have not yet applied Hotfix 4 remain exposed to all three vulnerabilities.

What is N-central, and why does this matter to ordinary people?

N-central is software that IT service companies use to remotely log into and manage the computers of their business customers, from small shops to hospitals. If attackers take control of N-central, they effectively hold a master key to every computer that service company manages.

That makes it an especially attractive target. An attacker who breaks into one N-central server can silently create their own administrator accounts, move through client networks, and plant further malicious software, all without any customer ever receiving a suspicious email or clicking a bad link.

How did this unfold?

The trouble started on 4 September, when cybersecurity firm Huntress began investigating a breach at a customer whose N-central server was fully patched at the time. Huntress later identified two flaws, tracked as CVE-2026-86206 and CVE-2026-86207, that together allowed attackers to bypass login controls and create unauthorised administrator accounts. N-able issued Hotfix 3 on 5 September to address those two bugs.

Then, on 6 September, N-able disclosed a third flaw: CVE-2026-86218. This one is a pre-authentication remote code execution vulnerability, meaning an attacker does not need a username or password to exploit it. They can simply connect to an exposed N-central server and take full control. N-able confirmed it has already been exploited in the wild.

Hotfix 4 supersedes Hotfix 3. Any system updated only to Hotfix 3 remains exposed to CVE-2026-86218 and must be upgraded again.

What should businesses using N-central do right now?

Apply Hotfix 4 immediately. That is the single most important step.

For companies that host N-central themselves (on-premises), N-able has not pushed the fix automatically. Administrators must download and install it manually using instructions on N-able's support portal. Cloud-hosted N-central instances have already received the mitigations from N-able directly.

Huntress also recommends restricting who can reach the N-central login screen in the first place. Allowing only known office IP addresses to connect, or routing access through a VPN (a private, encrypted tunnel that keeps the login page off the public internet), removes a large portion of the risk even before patching is complete.

Finally, Huntress advises reviewing recently created user accounts for suspicious names, particularly email addresses with ".invalid" added, and checking server logs for unusual activity against internal programming interfaces. Because historical logs on many systems are limited, Huntress cautions it cannot say with certainty which flaw was used in the 4 September breach.

CSO Online first reported the details of Huntress's exploit-chain findings.