CVE-2026-86218 – N-able N-central
“When attackers can run code on the console that manages your fleet, every endpoint becomes theirs. Patch N-central now.”
N-able has released fixes for three vulnerabilities in N-central, and attackers are actively exploiting all three: CVE-2026-86206, CVE-2026-86207 and CVE-2026-86218. The most serious, CVE-2026-86218, has a CVSS score of 10.0, Critical severity. It allows remote code execution before authentication and affects N-central versions before 2026.3.1.14. CVE-2026-86207 has a CVSS score of 7.7, High severity. It is an authentication bypass in internal-only APIs in versions before 2026.3 HF 3. CVE-2026-86206 has a CVSS score of 6.9, Medium severity. It is a flaw in the internal API access control filter that allows unauthorized access to internal APIs, and N-central 2026.3 HF3 and 2026.4 fix it.
N-central manages remote endpoints, so an attacker who takes over the console can reach every device it manages. Taken together, these flaws give attackers a direct path from no access to full control. Upgrade all N-central instances to a fixed release immediately.
Key Details
- Affected Product
- N-able N-central
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-96