CVE-2026-86218: N-able N-central Pre-Auth Remote Code Execution (KEV)

CVE-2026-86218 is a static code injection vulnerability in N-able N-central that lets a remote, unauthenticated attacker achieve pre-authentication remote code execution on the RMM server itself, and it carries both an NVD-confirmed critical score and CISA KEV listing, though N-able says it has no confirmation of in-the-wild exploitation.

CVE-2026-86218 is a Static Code Injection (CWE-96) in N-able N-central, the vendor's remote monitoring and management (RMM) platform. NVD's Analyzed record describes it plainly: "N-central is vulnerable to a pre-auth remote code execution. This issue affects N-central: before 2026.3.1.14" (NVD).

Unlike many recent CVEs, NVD has published its own independent Primary score here: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, no authentication or user interaction required, high impact across confidentiality, integrity and availability. A separate CNA-submitted CVSS v4.0 Secondary score of 10.0 is also on file (NVD).

N-able's own status-page post announcing the fix states the issue is "critical severity" and allows "pre-authenticated remote code execution on the N-central server." The fix shipped as N-central 2026.3 Hotfix 4 (build 2026.3.1.14) on 2026-09-06; hosted (NCOD) instances were patched automatically, while on-premises deployments require a manual upgrade, with direct upgrade paths supported from versions 2025.4 through 2026.3.1 Hotfix 2. The post states the vulnerability was found through N-able's own responsible-disclosure program and that, at time of publication, N-able had "no confirmations that this vulnerability has been exploited in production environments" (N-able Status: N-central 2026.3 Hotfix 4 – CVE-2026-86218).

CISA added CVE-2026-86218 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-08, with a required-action due date of 2026-09-11 and a forensic-triage requirement under BOD 26-04 — both signals that CISA's own intelligence differs from N-able's "no confirmation" statement and treats this as actively exploited (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.1539 (96.766th percentile) (FIRST EPSS).

Because N-central is an RMM platform with privileged access into every endpoint it manages, any on-premises instance older than 2026.3 Hotfix 4 should be upgraded immediately regardless of the vendor's "no confirmation" language, given CISA's independent KEV listing and forensic-triage requirement.

• N-able N-central before build 2026.3.1.14 is vulnerable to a static code injection flaw enabling pre-authentication remote code execution. — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — NVD's own Primary score (a separate CNA v4.0 Secondary score of 10.0 is also on file). — NVD
• Fixed in N-central 2026.3 Hotfix 4 (build 2026.3.1.14), released 2026-09-06; hosted NCOD instances auto-patched, on-premises need manual upgrade; found via N-able's responsible-disclosure program; N-able states no confirmed production exploitation as of the post date. — N-able Status: N-central 2026.3 Hotfix 4 – CVE-2026-86218
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-08, required-action due date 2026-09-11, flagged for CISA's forensic-triage requirement under BOD 26-04. — CISA KEV
• EPSS score is 0.1539 (96.766th percentile) as of 2026-10-27. — FIRST EPSS