Warning: CVE-2026-86218: N-able N-central Pre-Auth RCE, Patch Immediately!

A critical pre-auth static code injection vulnerability (CWE-96, CVE-2026-86218, CVSS 10.0) affects N-able N-central versions prior to 2026.3.1.14, allowing unauthenticated remote attackers to execute code on the server. Because N-central is an RMM platform with privileged access to managed devices, exploitation can lead to environment-wide compromise, data exposure, and ransomware propagation; the flaw is confirmed as actively exploited and listed in CISA's KEV catalog. Organizations running on-premises N-central are strongly advised to apply the vendor patch immediately, upscale detection and monitoring, and treat patching as not sufficient to remediate potential historical compromise.