Full Report
UPDATE: Critical vulnerability in N-able N-central gives attackers unauthenticated, "god-mode" access to the RMM console.
Analysis Summary
# Vulnerability: N-able N-central Pre-Authentication Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-86218 (Primary/Critical), CVE-2026-86206, CVE-2026-86207
- **CVSS Score:** 10.0 (Critical)
- **CWE:** Not specified, but involves Pre-authentication Remote Code Execution (RCE) and Access Control Bypass.
## Affected Systems
- **Products:** N-able N-central (RMM Platform)
- **Versions:**
- All versions prior to 2026.3 HF4.
- Specifically impacts 2026.3.1.13 (HF3) and earlier.
- **Configurations:** Impacts both on-premises and hosted (NCOD) deployments. On-premises deployments are at the highest risk if not manually patched.
## Vulnerability Description
This is a critical vulnerability chain that allows for unauthenticated, "god-mode" access to the RMM console. The latest disclosed flaw (CVE-2026-86218) allows for Pre-authentication Remote Code Execution (RCE). A separate chain (CVE-2026-86206 and CVE-2026-86207) allows attackers to bypass access controls to create unauthorized administrative accounts without prior credentials.
## Exploitation
- **Status:** Exploited in the wild; PoC available (developed by Huntress).
- **Complexity:** Low (unauthenticated access).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** Total (Access to all managed endpoint data).
- **Integrity:** Total (Ability to run scripts, push tools, and create admin accounts).
- **Availability:** Total (Full control over the RMM server and downstream managed agents).
## Remediation
### Patches
- **Immediate Action:** Apply **N-central 2026.3 Hotfix 4 (HF4)**.
- **Note:** This hotfix supersedes all previous updates (HF1, HF2, and HF3). Systems running HF3 remain vulnerable to CVE-2026-86218.
- Hosted (NCOD) instances have been patched automatically by N-able.
### Workarounds
- Strictly limit inbound network access to the N-central console via IP allow-listing.
- Disable public-facing access to the management interface if possible.
## Detection
- **Indicators of Compromise (IoC):**
- Presence of unauthorized administrative accounts.
- Specifically, audit user lists for emails ending in `.invalid`.
- **Detection Methods:**
- Review N-central audit logs for anomalous account creation or unexpected script execution.
- Monitor for unauthorized remote sessions initiated from the RMM console to downstream endpoints.
## References
- N-able Security Advisory (CVE-2026-86218): [https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution](https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution)
- N-able Status Page: [https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/](https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/)
- Huntress Blog: [https://www.huntress.com/blog/n-able-vulnerability-exploitation](https://www.huntress.com/blog/n-able-vulnerability-exploitation)