N-central CVE-2026-86218: patch to HF4 build 2026.3.1.14 now

N-able has published a hotfix for CVE-2026-86218, a critical, pre-authentication remote-code-execution vulnerability in its N-central remote monitoring and management platform. The company assigned it a CVSS 4.0 score of 10.0 and classified it as a static code injection weakness (CWE-96). On-premises and self-hosted N-central deployments need to upgrade to 2026.3 Hotfix 4, build 2026.3.1.14; N-able's cloud-hosted NCOD instances have already been patched by the vendor.

Scope and upgrade path

The flaw affects every N-central build released before 2026.3.1.14, including servers already on Hotfix 3 (build 2026.3.1.13), which N-able had shipped only hours earlier to fix two unrelated issues. Customers on 2025.4, 2026.1, 2026.2, 2026.3, or 2026.3.1 Hotfix 1 or 2 can upgrade directly to HF4; anyone on an older release should move to a supported version first and then apply the hotfix. Because the fix lives in the N-central server itself, an accompanying agent upgrade is not required for protection.

A third vulnerability in a short window

CVE-2026-86218 was disclosed one day after N-able fixed two other N-central issues, including an access-control filter bypass (CVE-2026-86206) that could expose internal APIs not meant to be reachable externally; that pair was tied to the discovery of a re-compromised customer server. N-able says CVE-2026-86218 was responsibly disclosed through its own security disclosure program.

Conflicting exploitation reports

N-able's official position is that it has no confirmation the vulnerability has been exploited in production environments, though it urges that unpatched systems be treated as at risk. Reporting on the disclosure has been inconsistent on this point — some coverage describes the flaw as actively exploited based on N-able's own statements, while incident responder Huntress says it has not independently reproduced the vulnerability or attributed new compromises to it since the September 6 update. MSPs should patch on the assumption of risk rather than wait for exploitation to be confirmed either way.

Because the vulnerability is pre-authentication, an internet-exposed N-central console is the primary attack path — restricting inbound access to the console while the upgrade is scheduled is a reasonable interim step. This is the third N-central disclosure in a matter of weeks, so treat the HF4 upgrade as part of a wider version audit rather than a one-off patch.

Sources: N-able Status — N-central 2026.3 Hotfix 4, CVE-2026-86218, The Hacker News, Help Net Security.