CVSS 10.0, Priority Score 0.00 — and Still This Week's Most Urgent Patch

On 6 September, N-able issued an emergency update for its N-central RMM platform. CVE-2026-86218 permits code execution before login — no valid account, no user interaction. Fixed in N-central 2026.3 Hotfix 4, build 2026.3.1.14.

For anyone self-hosting, that is this week's most urgent patch. What makes the case interesting is something else: in the NEOSEC Intel prioritisation, this CVE scores 0.00.

The numbers that contradict each other

A 10.0 alongside a 0.4 percent exploitation probability. A priority score of zero for a flaw the vendor rates critical and patches out of band.

Both figures are computed correctly. And both mislead if you read only the number.

Why EPSS is structurally blind here

EPSS estimates the probability of real-world exploitation within the next 30 days. The model draws on publicly available exploit code, mentions in relevant sources, and how widely the affected product is deployed.

For CVE-2026-86218 there is no public PoC, no technical detail, no root-cause information — N-able deliberately published none of it. And N-central is not a mass-market product like a web server but a management platform with a comparatively small, high-value install base.

To the model that reads as little signal. To an attacker it reads as something quite different.

A low EPSS value measures the absence of public signal, not the absence of interest. For a product whose customer base is managed service providers, that distinction decides the case.

What the CVSS vector says when you read it rather than count it

The 10.0 is not inflation. The v4 vector reads:

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Network, low complexity, no prerequisites, no privileges, no user interaction. And then the part that is new in CVSS v4 and decisive here: SC:H/SI:H/SA:H — subsequent system impact high across the board.

That is the formal statement that damage does not stop at the compromised host. For an RMM platform this is not theory but architecture: an N-central server administers endpoints across customer environments. Whoever controls it controls not a server but a distribution channel.

The CVE record also carries the CISA Coordinator's SSVC assessment: exploitation: none, but automatable: yes. No observed attack yet — but an attack that could be automated.

The history the news item omits

This is not N-central's first incident. It is the third in thirteen months, and the trend runs the wrong way.

August 2025. CVE-2025-8875 (insecure deserialisation) and CVE-2025-8876 (command injection) were added to the CISA KEV catalogue on the day of disclosure — with no technical detail and no public PoC available, a strong indication of zero-day exploitation. N-able confirmed exploitation in a limited number of on-premises environments. Both flaws were post-authentication; observers treated that as a mitigating factor at the time.

August 2026. Almost exactly a year later, active exploitation again and another KEV addition, this time involving authentication bypass and administrative access on the server.

September 2026. CVE-2026-86218, now pre-authentication. The mitigating factor from 2025 is gone.

The hotfix cadence tells the same story: Hotfix 3 was build 2026.3.1.13, Hotfix 4 is 2026.3.1.14. Two emergency updates in quick succession.

Who needs to do what

Hosted environments (NCOD) are already patched according to N-able; no action required.

Self-hosted installations need build 2026.3.1.14. Direct upgrades are supported from 2025.4, 2026.1, 2026.2, 2026.3 and 2026.3.1 Hotfixes 1 and 2. Older releases must first move to one of those intermediate builds. Agents do not need updating for this particular flaw.

Four points that go beyond simply applying the update:

1. Preserve logs before maintenance begins. Write off server and authentication logs, then patch. An update does not remove the traces of a compromise that already happened — but maintenance work can overwrite them. Discover after patching that you were compromised and you will want the logs from before.
2. Check and reduce exposure. Identify every self-hosted N-central server, verify its build number, restrict administrative interfaces to approved management networks. An internet-reachable RMM server is a decision you should be able to justify after the year this product has had.
3. Review retrospectively. Unusual access, anomalous process execution, new accounts, altered scripts or automation tasks. On a platform that distributes code to endpoints, the question of tampered automation matters at least as much as the server itself.
4. Review privileges. Which accounts have access, which service accounts hang off it, what can be reached from there?

The point that outlives this case

We have argued elsewhere why CVSS alone cannot carry prioritisation and why EPSS and KEV status are the better signals. This case is the counter-example — and instructive for that reason.

EPSS says 0.4 percent. KEV says not listed. The priority score says 0.00. All three point down, and all three are correct in themselves.

What they cannot know is that this one server administers hundreds of customer environments. Asset context is the variable no external score contains — it comes from your own inventory. A prioritisation model without asset weighting produces a suggestion, not a decision.

For NEOSEC Intel this is concrete: the priority score condenses technical severity, exploitation probability, KEV status and asset context into a single ranking. In the public catalogue the last of those four is necessarily absent — there is no customer linkage there. And then the score reads zero, as here, for a flaw you close tonight.

And for managed service providers there is a sentence worth repeating: your management platform is your customers' supply chain. NIS2 Article 21(2)(d) requires supply chain security. For a company whose IT provider runs N-central, the patch level of that server is a matter of its own compliance — even though the server belongs to someone else.

That is a question you are entitled to ask. And one you should be able to answer if you are the provider.

Sources

• CVE-2026-86218 in the NEOSEC Intel catalogue
• N-able security advisory for CVE-2026-86218
• N-able status: N-central 2026.3 Hotfix 4
• BSI CERT-Bund WID-SEC-2026-3205
• Tamilselvan, "Critical N-able N-central Flaw Enables Unauthenticated Pre-Auth Remote Code Execution", Cyber Press, 7 September 2026
• CISA — addition of CVE-2025-8875 and CVE-2025-8876 to the KEV catalogue, 13 August 2025

No CVSS value was visible at the time of the Cyber Press report. The vendor's CVE record as CNA now carries a CVSS v4 base score of 10.0.