CVE-2026-86218 · High · CISA KEV

N-able N-central Pre-Auth RCE: Critical Risk for Managed Environments

Threat Engine Auto-Feed · data current as of 2026-09-09

CVE-2026-86218 in N-able N-central allows for pre-authentication remote code execution due to a static code injection vulnerability. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog. Organizations using N-able N-central are at high risk of compromise, particularly those with internet-exposed instances.

  • CVSS:
  • EPSS percentile: 0.52602
  • Exploitation pressure: 57/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 53th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves 'static code injection,' meaning that an attacker can insert malicious code into the application's programming logic before any authentication occurs. This injected code is then executed by the system, granting the attacker control over the affected software.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Managed Service Providers (MSPs)
  • Enterprises utilizing N-able N-central for IT management
  • Organizations in Financial Services and Technology sectors (due to observed threat actor targeting)

Misconfigurations that escalate it

  • Internet-facing N-able N-central instances without proper network segmentation or access controls
  • Lack of robust monitoring for unusual activity on N-able N-central servers

High-impact scenarios

  • Complete compromise of the N-able N-central server, leading to control over managed endpoints and client environments
  • Data exfiltration and deployment of ransomware across the managed IT infrastructure
  • Establishment of persistent access for espionage or financial theft by sophisticated threat actors

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor N-able N-central server logs for unusual process execution or unauthorized access attempts.
  • Implement network intrusion detection systems (NIDS) to identify anomalous traffic patterns originating from or destined for N-able N-central instances.
  • Regularly audit N-able N-central configurations for any unauthorized changes.

Contain

  • Isolate affected N-able N-central instances from the network immediately upon detection of compromise.
  • Block all external access to N-able N-central until a thorough investigation and remediation can be performed.
  • Review and revoke any potentially compromised credentials associated with N-able N-central.

Patch

  • Apply vendor-provided patches for N-able N-central as soon as they become available.
  • If patches are not immediately available, consider implementing temporary compensating controls such as restricting network access to trusted IP ranges only.

Frontier verdict — High

This is a critical vulnerability (CVE-2026-86218) in N-able N-central, confirmed to be exploited in the wild (CISA KEV), allowing pre-authentication RCE, demanding immediate defensive action.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.