N-able N-central Static Code Injection Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2026-86218 · Published 06/09/2026 · updated 09/09/2026

N-able N-central Static Code Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 08/09/2026. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
n-central n-able	`= 2026.3< 2026.3`	`2026.3`

Description

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

References

me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2026-86218

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free