N-able patches max severity N-central flaw amid ongoing attacks

N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) vulnerability, CVE-2026-86218, affecting its N-central remote monitoring and management platform. The flaw allows unauthenticated attackers to execute arbitrary code on exposed on-premises instances with low attack complexity. Although N-able has not confirmed active exploitation, Huntress warns it may be a zero-day and notes ongoing attacks targeting unpatched systems. The vulnerability follows previous incidents involving N-central, with hundreds of internet-exposed instances still potentially vulnerable despite prior patches.

AI-extracted · verify before operational use