N-able ships N-central hotfix for critical RCE

N-able posted a status notice for N-central 2026.3 Hotfix 4, last updated 5 September 2026. The build is 2026.3.1.14 and it closes CVE-2026-86218, a critical-CVSS vulnerability that could allow pre-authenticated remote code execution on the N-central server. Matching HF4 release notes sit with the status-page update. The bug is not on CISA's Known Exploited Vulnerabilities list.

The bug was responsibly disclosed by a third party through N-able's security disclosure program. N-able says it has no confirmations that the vulnerability has been exploited in production environments, but unpatched systems remain at risk.

On-premises and self-hosted customers must upgrade to 2026.3 HF4 (2026.3.1.14) immediately. Hosted N-central (NCOD) already has the patches applied, and those customers have no action. The hotfix supersedes HF3 build 2026.3.1.13. Direct upgrade paths run from 2025.4, 2026.1, 2026.2, 2026.3, and earlier 2026.3.1 hotfixes. Agents do not need to be upgraded for this CVE.

BleepingComputer cites Shadowserver tracking nearly 1,500 N-central servers exposed online, mostly in the United States and Europe. Huntress flagged CVE-2026-86218 as a potential zero-day alongside CVE-2026-86206 and CVE-2026-86207, two auth-bypass bugs patched over the weekend in HF3. Huntress could not confirm which CVE hit a customer production environment because logs on that server had already rotated. It warns that HF3 remains vulnerable to the new RCE, so on-premises operators still need HF4.

N-able's line is no confirmed production exploitation. Huntress calls the new bug a potential zero-day and cannot attribute that earlier compromise to a specific CVE. Those two statements can sit together. Neither source has documented a confirmed mass exploitation campaign. Internet-facing RMM consoles keep drawing the same risk seen in a ScreenConnect guest file-transfer worm.

Some offers on this page may be paid placements or contain affiliate links.