{"id":2752,"date":"2026-09-09T05:17:13","date_gmt":"2026-09-09T05:17:13","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2752"},"modified":"2026-09-09T05:17:13","modified_gmt":"2026-09-09T05:17:13","slug":"n-able-n-central-pre-auth-rce-flaw-exploited-in-the-wild","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2752","title":{"rendered":"N-able N-central Pre-Auth RCE Flaw Exploited in the Wild"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 09, 2026<\/span><\/span>Vulnerability \/ Code Injection<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added<\/a> a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV<\/a>) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 11, 2026.<\/p>\n

The vulnerability in question is CVE-2026-86218<\/a><\/strong> (CVSS score: 10.0), which has been described as a case of static code injection. It has been patched in N-central 2026.3 Hotfix 4<\/a>, released on September 5, 2026.<\/p>\n

\u00abN-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution,\u00bb CISA said.<\/p>\n

The development came shortly after Huntress said it commenced an investigation following the compromise of a customer’s fully patched N-central production environment on September 4, 2026.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

However, it remains unclear if the intrusion involved CVE-2026-86218 or two other vulnerabilities (CVE-2026-86206 and CVE-2026-86207<\/a>) that were patched by N-able the same day with N-central 2026.3 Hotfix 3. CVE-2026-86206 and CVE-2026-86207 can be chained together to allow a remote unauthenticated attacker to bypass authentication and create a new attacker-controlled System Administrator account on an affected server, per Rapid7’s Stephen Fewer<\/a>, who discovered and reported them.<\/p>\n

\u00abDue to limited historical logging available directly on the appliance, we cannot definitively confirm which specific exploit the threat actor used to achieve their compromise, nor can we rule out the use of alternative vulnerabilities,\u00bb Huntress noted<\/a>.<\/p>\n

In a separate \u00aburgent\u00bb notice<\/a> sent directly to customers, N-able said CVE-2026-86218 \u00abhas been observed being exploited in the wild\u00bb and that it’s \u00abactively investigating this matter and have taken additional steps to help protect customer environments.\u00bb It also urged customers to apply the hotfix immediately. <\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Sep 09, 2026Vulnerability \/ Code Injection The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities…<\/p>\n","protected":false},"author":1,"featured_media":2753,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[128,70,2847,2848,1040,316,656],"class_list":["post-2752","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-exploited","tag-flaw","tag-nable","tag-ncentral","tag-preauth","tag-rce","tag-wild"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2752","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2752"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2752\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2753"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2752"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2752"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2752"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}