N-able has issued an urgent security update for a critical vulnerability in its N-central remote monitoring and management (RMM) platform that could let an unauthenticated attacker execute code on a vulnerable server before logging in.
Tracked as CVE-2026-86218, the issue is fixed in N-central 2026.3 Hotfix 4, build 2026.3.1.14. N-central is used by managed service providers and IT teams to administer endpoints and customer environments from a central console.
A pre-authentication remote code execution flaw is especially serious in that role: exploitation would not require valid N-central credentials, potentially giving an attacker a foothold on the management server that can span the administered infrastructure.
Critical N-able N-central Flaw
N-able has rated CVE-2026-86218 as critical, but has not published technical root-cause details, affected components, a CVSS numeric score, proof-of-concept code, or indicators of compromise.
The bug was responsibly disclosed through the vendor’s security disclosure program. N-able said it has no confirmed evidence of exploitation in production environments as of the advisory’s publication; that statement should not be treated as evidence that exposed self-hosted servers are safe to defer patching.
The remediation is included in N-central 2026.3 Hotfix 4, released as build 2026.3.1.14 and superseding Hotfix 3, build 2026.3.1.13. Direct upgrades to the new build are supported from versions 2025.4, 2026.1, 2026.2, 2026.3, and 2026.3.1 Hotfixes 1 and 2.
Administrators on older releases must first migrate to one of the supported intermediate builds, then install the hotfix.
The company said hosted N-central, or NCOD, customers do not need to take any action because patches have already been applied to those environments.
The urgent action applies to self-hosted deployments, where administrators must download and install the updated server build. Updating N-central agents is not required to mitigate this specific vulnerability, although N-able recommends keeping agents on their latest available versions.
Security teams should identify every internet-reachable and internally exposed self-hosted N-central server, verify its build number, and prioritize installation of 2026.3.1.14.
Organizations should also preserve relevant server and authentication logs before maintenance, review for unusual access or process execution, and restrict administrative interfaces to approved management networks wherever operationally feasible.
Because a successful pre-authentication RCE can bypass the normal credential barrier, defenders should treat the N-central server as a high-value control-plane asset.
Rapid patching, exposure reduction, privileged-access review, and heightened monitoring are appropriate until the update is deployed and validated.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
 platform that could let an unauthenticated attacker execute code on a vulnerable server before logging in.){kind=link}