N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
Read original article ↗AI Summary
A critical pre-authentication remote code execution vulnerability, CVE-2026-86218 (CVSS score: 10.0), in N-able N-central is being actively exploited in the wild. The flaw allows unauthenticated attackers to execute arbitrary code remotely, enabling full compromise of the platform used by MSPs and large IT organizations to manage downstream systems. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by September 11, 2026. Although N-able released a fix in version 2026.3 Hotfix 4, evidence suggests prior exploitation of internet-facing instances, with potential links to ransomware threat actors.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.