N-able released N-central 2026.3 Hotfix 4 on 6 September 2026 to fix CVE-2026-86218, a critical pre-authentication remote code execution flaw in the N-central server. Two days later, on 8 September, CISA added it to the KEV catalog with a due date of 11 September. N-central manages endpoints for many customers, so a compromised server is a long reach.
N-able's own notice said it had no confirmation of production exploitation at the time of posting. The KEV listing came after that, and the CISA entry carries the forensic triage flag.
What's affected
- Product: N-able N-central, self-hosted. NVD lists the issue as affecting versions before 2026.3.1.14.
- Fixed: build 2026.3.1.14 (2026.3 Hotfix 4), which supersedes Hotfix 3 (2026.3.1.13).
- CVSS: 9.8 on CVSS 3.1 and 10.0 on CVSS 4.0 in NVD. CISA classes it as static code injection (CWE-96).
- Hosted (NCOD): N-able says patches are already applied, with no action required.
- Upgrade paths to 2026.3.1.14: 2025.4, 2026.1, 2026.2, 2026.3, and 2026.3.1 Hotfix 1 or 2. Older versions need an intermediate upgrade first.
- Agents: the hotfix does not require agent upgrades to address this CVE.
N-able published no workaround and no indicators of compromise.
What to do now
- Check your N-central server version in the admin console. If it is below 2026.3.1.14, upgrade now.
- Restrict access to the N-central web interface to known networks until the upgrade is done.
- Because the flaw is pre-authentication and now in KEV, review the server for compromise: new admin users, unfamiliar scripts or scheduled tasks pushed to managed devices, and unexpected outbound connections.
- If anything looks wrong, review what the server has pushed to managed endpoints recently.
Quick check
Do hosted N-central customers need to act on CVE-2026-86218?
No. N-able states the hosted service (NCOD) was already patched and no action is required. Self-hosted servers must be upgraded to 2026.3.1.14.
