CVE-2026-86218Vulnerability
N-able N-central Static Code Injection Vulnerability
Reported by 6 independent sources · first reported by Huntress · last reported
Last reported 12 days ago
Fix due 11 Sep 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 96% of CVEsFIRST EPSS, as of 24 Oct 2026
What the reports say
6 reports, newest first · the exact sentence from each-
September 2026 CVE Landscape“CVE-2026-86218”
-
Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules“CVE reference: CVE-2026-86218”
-
CVE-2026-86218 | N-able N-central Pre-Authentication Remote Code Execution Vulnerability“CVE-2026-86218 | N-able N-central Pre-Authentication Remote Code Execution Vulnerability”
-
Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal“Tracked as CVE-2026-86218, the zero-day is different from the two critical vulnerabilities the company patched on Friday last week.”
-
N-able Releases Hotfix for Critical Remote Code Execution Vulnerability“CVE-2026-86218 is a critical pre-authentication RCE flaw in N-central, N-able’s remote monitoring and management platform.”
-
Critical N-able N-central Vulnerability and Active Exploitation“UPDATE 9/6/26: N-able issued [Hotfix 4 (2026.3 HF4)] to address CVE-2026-86218, an actively exploited pre-auth RCE zero-day with a 10.0 CVSS score that supersedes all prior hotfixes.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-85880, CVE-2026-81963, CVE-2026-18556, CVE-2026-18577, CVE-2026-86206, CVE-2026-86207, CVE-2026-75650, CVE-2026-60004, CVE-2022-0847, CVE-2026-35273, CVE-2026-85046, CVE-2026-87491, CVE-2026-48710, CVE-2025-39964, CVE-2026-0770, CVE-2026-20316, CVE-2026-39987, CVE-2026-60137, CVE-2026-63030, CVE-2021-29441
Thanks — we review every report.