GoKawiilN-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform.
IT departments and managed service providers (MSPs) use the N-central platform to monitor, manage, and maintain client networks and devices from a centralized web-based console.
Tracked as CVE-2026-86218, this RCE vulnerability allows threat actors without privileges to execute malicious code on unpatched N-central instances exposed online in low-complexity attacks.
N-able addressed the flaw on Saturday by releasing N-central 2026.3 Hotfix 4 and urging customers to patch as soon as possible.
"At this time, we have no confirmations that this vulnerability has been exploited in production environments, but unpatched systems remain at risk," the company said.
"Customers running on-premises N-central deployments should upgrade to N-central 2026.3 HF4 immediately to protect their environment."
Internet security nonprofit Shadowserver Foundation now tracks nearly 1,500 N-central servers exposed online, most of them located in the United States and Europe.
Internet-exposed N-able N-central instances (Shadowserver)
Evidence of active exploitation
While N-able has yet to confirm that the CVE-2026-86218 flaw is being targeted, cybersecurity company Huntress has flagged it as a potential zero-day, along with two high-severity vulnerabilities (tracked as CVE-2026-86206 and CVE-2026-86207, and also patched over the weekend) that can allow attackers to bypass authentication and gain full access to the vulnerable N-central platform.
... continue reading