N-able N-central zero-day chain puts MSP environments at risk

The N-able N-central remote monitoring and management platform, widely used by managed service providers (MSPs) and IT departments, contains a critical vulnerability CVE-2026-86218 with the maximum CVSS score of 10.0, which allows arbitrary code execution without prior authentication. According to N-able, the vulnerability is already being exploited in real-world attacks. At the same time, two additional vulnerabilities — CVE-2026-86206 and CVE-2026-86207 — were disclosed, forming an authentication bypass chain. Organizations using N-central must immediately update to version 2026.3 Hotfix 4 (2026.3.1.14), which addresses all three vulnerabilities.

Technical details of the vulnerabilities

CVE-2026-86218 — static code injection (CVSS 10.0)

The vulnerability is classified as static code injection and allows a remote unauthenticated attacker to execute arbitrary code on the N-central server. According to the entry in the GitHub Advisory Database, all versions prior to 2026.3.1.14 are vulnerable. The fix was released as part of N-central 2026.3 Hotfix 4. An important nuance: systems updated only to Hotfix 3 (2026.3.1.13) remain vulnerable to CVE-2026-86218.

CVE-2026-86206 and CVE-2026-86207 — authentication bypass chain

These two vulnerabilities, discovered by researcher Stephen Fewer of Rapid7, when used together allow a remote unauthenticated attacker to create a system administrator account fully controlled by the attacker. According to Rapid7’s technical analysis:

• CVE-2026-86206 (CVSS v4: 6.9) — access control bypass via semicolon path manipulation and spoofing of the Forwarded header.
• CVE-2026-86207 (CVSS v4: 7.7) — authentication bypass in the UserTwoFactorLogin workflow.

Both vulnerabilities are fixed in Hotfix 3 (version 2026.3.1.13). All earlier versions are vulnerable. According to Rapid7, the disclosure timeline is as follows: vendor notification — 27 August 2026, transmission of technical details — 28 August, release of Hotfix 3 — 5 September, public disclosure — 8 September.

Confirmed compromise and attribution uncertainty

Huntress began an investigation on 4 September 2026 after detecting a compromise of a fully updated production N-central environment at one of its customers. The key issue: due to the limited amount of historical logging on the device, Huntress was unable to determine exactly which vulnerability was used — CVE-2026-86218, CVE-2026-86206, CVE-2026-86207, or something else.

It is important to note a significant contradiction between sources. Huntress cites N-able when describing CVE-2026-86218 as being exploited in the wild. However, according to the same Huntress report, N-able’s release notes stated that exploitation in production environments had not been confirmed. This discrepancy prevents the exploitation status of CVE-2026-86218 from being clearly and unambiguously classified. Nonetheless, the fact of the customer environment compromise itself is confirmed by Huntress with a high degree of confidence.

None of the available sources attributes the attack to any specific threat group or actor.

Impact assessment

N-able N-central is an RMM-class (remote monitoring and management) platform that MSPs use to manage the infrastructure of hundreds and thousands of customers simultaneously. Compromise of a single N-central server can potentially open access to all endpoints managed through it. This makes the vulnerability particularly dangerous for:

• MSP providers — compromise of the management server means cascading access to customer networks.
• Corporate IT departments that use N-central for centralized device fleet management.
• Organizations that are MSP customers and may not even be aware that N-central is present in their management chain.

The pre-authentication nature of all three vulnerabilities means that exploitation does not require credentials — only network access to the N-central server.

Recommendations

1. Immediately update N-central to version 2026.3.1.14 (Hotfix 4). This version fixes all three vulnerabilities. Updating only to Hotfix 3 (2026.3.1.13) closes CVE-2026-86206 and CVE-2026-86207 but leaves the system vulnerable to CVE-2026-86218.
2. Review N-central server logs for signs of anomalous activity, in particular: creation of new administrator accounts, unusual API requests, suspicious Forwarded headers in web server logs.
3. Restrict network access to N-central servers — they should not be directly accessible from the internet without additional protections in place (VPN, network segmentation, allowlisted IP ranges).
4. Audit accounts with system administrator privileges in N-central — the presence of unknown accounts may indicate exploitation of the CVE-2026-86206/CVE-2026-86207 chain.
5. For organizations serviced by an MSP: request confirmation from your provider that Hotfix 4 has been applied and that checks for compromise have been completed.

Given the confirmed compromise of a fully updated environment, the maximum CVSS score, and the pre-authentication attack vector, updating to N-central 2026.3.1.14 should be treated as a zero-day-level priority. Organizations that cannot update immediately should at minimum isolate N-central servers from external network access and strengthen monitoring until the patch is applied.