N-central: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') (CVE-2026-86218)

What is affected, what to do

A critical code injection vulnerability (CWE-96) in N-able N-Central allows unauthenticated remote attackers to execute arbitrary server-side code without any user interaction. Successful exploitation grants full control over the affected system, compromising confidentiality, integrity, and availability. The vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities catalog, underscoring the immediacy of the threat. Organizations running N-able N-Central must apply the available patch without delay and investigate their environments for signs of compromise.

The vulnerability is being actively exploited; treat it as a priority. Update N-able N-central to version 2026.3.1.14. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• N-able N-central lt *..2026.3.1.14

Fixed in

• N-able N-central 2026.3.1.14

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every self-hosted N-central server (on-prem appliance or VM) and check the installed version in the admin console. Every version before 2026.3.1.14 is vulnerable. For hosted N-central, get written confirmation of the patch status from N-able or your MSP.
   • Patch: Upgrade to N-central 2026.3.1.14 or later. Until the upgrade is complete, treat any internet-facing server as potentially compromised.
   • Cut exposure now: If you cannot patch within hours, firewall the web/management UI so only known admin networks and the VPN can reach it. Restrict agent communication to known customer or site IP ranges where operationally feasible.
   • Check for compromise before patching: Preserve a snapshot or forensic image of the appliance, plus web, application and system logs. Patching does not remove webshells or backdoors that are already in place.
   • Rotate credentials (on suspicion or confirmed exposure): Renew N-central admin accounts, API tokens and integration keys (PSA, backup, SSO). Also rotate any domain or device credentials stored in the platform for managed endpoints.
   • Freeze automation: Review new or recently modified Automation Policies, scripts and scheduled tasks. Disable anything unrecognised before it can push to managed endpoints.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Move the N-central server into a dedicated management zone. Allow egress only to required destinations (vendor update servers, mail relay, PSA). Block and log all other egress, especially outbound HTTP/HTTPS to arbitrary hosts.
   • Pre-application access control: Expose the admin UI only through a VPN, ZTNA or a reverse proxy that enforces authentication (MFA/SSO) in front of it. This stops pre-auth exploitation at the network layer.
   • WAF/IPS: Deploy vendor IPS/WAF signatures for CVE-2026-86218 as soon as they ship. In the interim, block unauthenticated requests to the N-central web UI that carry oversized or code-like parameters (Java/script expressions, Runtime, exec, ProcessBuilder, Base64 blobs).
   • Appliance hardening: Limit local shell and SSH access to a bastion network. Put file-integrity monitoring (AIDE/auditd) on the web and application directories, and switch off unused services.
   • IAM/least privilege: Reduce credentials stored in N-central to the minimum rights needed, and never use Domain Admin. Keep separate accounts per customer or site to contain blast radius.
   • Endpoint side: Configure EDR to log processes launched by the RMM agent and block suspicious chains (e.g. agent → PowerShell download cradle).
3. 03

   Runbook step 3

   Detection rules

   • Server process ancestry (auditd/EDR): Watch for the N-central Java application-server process spawning shells or tooling such as sh, bash, curl, wget, python, perl or nc. Sigma shape: ParentImage|endswith: '/java' AND Image|endswith: ['/sh','/bash','/curl','/wget','/python3','/nc']. auditd: -a always,exit -F arch=b64 -S execve -F ppid=<java-pid> -k ncentral_exec.
   • Web/application logs: Look for unauthenticated POST requests with unusually long or code-bearing parameters, bursts of HTTP 500 errors from a single source, and new or unknown JSP or script files in web directories. Alert via FIM on *.jsp and *.class files written outside upgrade windows.
   • Network telemetry (Zeek/Suricata): Flag outbound connections from the N-central server to unknown IPs or domains, especially right after inbound internet requests. Zeek approach: conn.log where id.orig_h == <ncentral_ip> and the destination is not on the allowlist.
   • RMM abuse (EDR, Sysmon EID 1): Watch for the same new script or binary running on many endpoints within minutes via the N-central agent. KQL: DeviceProcessEvents | where InitiatingProcessFileName has "agent" and FileName in~ ("powershell.exe","cmd.exe","rundll32.exe") | summarize dcount(DeviceName) by ProcessCommandLine, bin(Timestamp,15m) | where dcount_DeviceName > 10.
   • N-central audit trail: Track new admin users, role changes, new API keys, new Automation Policies, and remote sessions outside maintenance windows. Forward these events via syslog to the SIEM and correlate them against known admin accounts.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

Source: BSI WID Portal

Weakness classes (CWE)

• CWE-96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

  Base

  The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

  Entry at MITRE CWE-96

References & sources

• me.n-able.coms/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthenti…Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218government-resource
• documentation.n-able.comN-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release…Release notes
• me.n-able.coms/security-advisory/aArVy0000002LUzKAM/cve202686207-authenticat…Vendor advisory
• me.n-able.coms/security-advisory/aArVy0000002LTNKA2/cve202686206-access-cont…Vendor advisory

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. CVE Modified09.09.2026134c704f-9b21-4f2e-91b3-4a467353bcc0

   • SSVC: before {"id":"CVE-2026-86218","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic… after {"id":"CVE-2026-86218","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic…

2. Initial Analysis08.09.2026nvd@nist.gov

   • CVSS V3.1: after AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
   • CPE Configuration: after OR *cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:* versions up to (excluding) 2026.3 *cpe:2.3:a:n-able:n-central:2026.3:-:*:*:*:*:*:* *cpe:2.3:a:n-able:n-central:2026.3:hotfix1:*:*:*:*:*:* *cpe:2.3:a:n-able:n-central:2026.3:hotfix2:*:*:*:*:*:* *cpe:2.3:a:n-able:n-central:2026.3:hotfix3:*:*:*:*:*:*
   • Reference Type: after CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218 Types: US Government Resource
   • Reference Type: after N-able: https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution Types: Vendor Advisory

3. CVE Modified08.09.2026134c704f-9b21-4f2e-91b3-4a467353bcc0

   • Reference: after https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218
   • SSVC: before {"id":"CVE-2026-86218","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical… after {"id":"CVE-2026-86218","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic…

4. CVE CISA KEV Update08.09.20269119a7d8-5eab-497f-8521-727c672e3725

   • Date Added: after 2026-09-08
   • Due Date: after 2026-09-08
   • Required Action: after 2026-09-08
   • Vulnerability Name: after 2026-09-08

5. CVE Modified08.09.2026134c704f-9b21-4f2e-91b3-4a467353bcc0

   • SSVC: before {"id":"CVE-2026-86218","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical… after {"id":"CVE-2026-86218","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical…

Linked advisories

• N-able N-central Pre-Auth RCE Flaw Exploited in the WildThe Hacker News09.09.2026
• Back-to-back N-able bugs send admins on a patching spreeCSO Online07.09.2026