N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
Read original article ↗AI Summary
N-able has released Hotfix 4 (build 2026.3.1.14) for its N-central RMM platform to address CVE-2026-86218, a critical unauthenticated remote code execution vulnerability with a CVSS score of 10.0. The flaw affects all on-premises builds prior to 2026.3.1.14, including those recently updated to Hotfix 3. N-able's incident notice states the vulnerability has been exploited in the wild, though the company's release notes claim no confirmed exploitation. Huntress observed a compromise of a fully patched N-central environment and reproduced a PoC exploit chain, but could not confirm whether CVE-2026-86218 was the exploited vector due to log rotation.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.