Home Blog Rapid Response: Critical N-able N-central Vulnerability and Active Exploitation Last Updated: September 6, 2026 Rapid Response: Critical N-able N-central Vulnerability and Active Exploitation By: Ben Bernstein John Hammond Summarize with AI Summarize ChatGPT Claude Perplexity Google AI Key Takeaways UPDATE 9/6/26: N-able issued [ Hotfix 4 (2026.3 HF4) ] to address CVE-2026-86218 , an actively exploited pre-auth RCE zero-day with a 10.0 CVSS score that supersedes all prior hotfixes. On-premises N-central users must apply HF4 immediately, as systems running HF3 remain vulnerable to this newly disclosed flaw. Hosted (NCOD) instances have already been patched by N-able. UPDATE 9/5/26: Huntress has produced a proof of concept (PoC) exploit of a net new vulnerability chain ( CVE-2026-86206 and CVE-2026-86207 ) in N-central. This is distinct from the August flaws and would allow attackers to bypass access controls to create unauthorized administrative accounts. N-able has released a new security advisory and hotfix ( 2026.3.1.13) ; all N-Central customers must plan to apply this new patch immediately , audit user lists for anomalous account creation (such as .invalid emails), and strictly limit inbound network access to the console. In August 2026, N-able disclosed a critical vulnerability impacting all current versions of N-central, including 2026.3 , across both hosted and on‑prem deployments. The flaw can give attackers unauthenticated, "god-mode" access to the RMM console. On August 2, a hotfix was released, followed by a second hotfix on August 6, and N-able is recommending all customers upgrade to the hotfix version (2026.3.1.10) immediately. Exploitation is active in the wild; a compromised N-central server can be used to run scripts, push tools, and open remote sessions across every downstream endpoint it manages. As of publication, Huntress has seen exploitation impacting one organization in our customer base; we are continually hunting N-central–related activity in our telemetry and reviewing logs that align with N‑able's described tradecraft. MSPs using N-central should apply N-able's 2026.3.1.10 hotfix, which you can find more information about here (along with documentation and release notes ). Potentially impacted organizations should also lock down access to N-central, review N-central activity for suspicious logins and remote-control sessions, and (for Huntress customers) ensure Managed Response isolation and remediation are enabled wherever possible. Because this vulnerability bypasses normal authentication, if your N-central server is still broadly reachable from the internet or other untrusted networks, you should consider temporarily disabling N-central—up to and including taking the server offline—until N-able's hotfix is applied and you can bring it back up behind strict network controls. Acknowledgments : Special thanks to Aaron Deal, Chris Bisnett, Aaron Bennett, Sharon Martin, Dave Kleinatland, James Northey, Josh Kiriakoff, Kamal Bennoune, Susannah Matt, and Michael Tigges for their contributions to this investigation and write-up. Update: 9/6/26 @ 7:30 AM ET In the early morning hours (U.S. time) of 9/6/2026, Huntress was alerted to a new CVE ( CVE-2026-86218 ) and fourth hotfix via a Discord post on MSPGeek. Notably, this third CVE is an N-central pre-auth remote code execution vulnerability rated with a 10.0 CVSS score, which is the maximum allowable rating and higher than the previous two CVEs published on 9/5. N-able also said that this release supersedes N-central 2026.3 Hotfix 3 (build 2026.3.1.13). Here's the full notes from Jason Murphy with N-able in that MSPGeek Discord thread: We recently communicated about two security vulnerabilities within N-central that were responsibly disclosed by a third party through our voluntary security disclosure program and we issued a hotfix. Since the disclosures, a third, independent researcher alerted us to a new vulnerability that has been exploited in the wild that is unrelated to the previously disclosed CVEs. This critical zero-day vulnerability, if exploited, could allow for pre-authenticated access to the N-central server. What You Need to Do • N-central On-Premises Environments: Upgrade to 2026.3 HF4 immediately. Hotfix link: [ 2026.3 HF4 Release Notes ] • If you've already upgraded to 2026.3 HF3, you will need to upgrade to 2026.3 HF4 to protect against this newly discovered vulnerability . • N-central Hosted Environments: No action is needed on your part; your instances have already been patched. • N-able's HF4 release notes include supported upgrade paths and installation guidance. In follow up conversation to the above message, Jason explicitly mentioned "this one is a Zero day." The vulnerability has also been detailed in an Active N-able Incident page with the details here: https://uptime.n-able.com/event/201814/ Exploited in the Wild? Notably, in both the MSPGeek post above and on N-able's Active Incident post they said the vulnerability has been observed being exploited in the wild. However, N-able's Release Notes said: "At this time, we have no confirmations that this vulnerability has been exploited in production environments, but unpatched systems remain at risk". In our 9/5/26 update (below), we had said we could not rule out whether the two previous vulnerabilities released ( CVE-2026-86206 and CVE-2026-86207 ) were the ones that were exploited in the instance seen in the patched production environment of one of our customers. Because logs on the compromised N-central server had already rotated, we are also unable to say whether this new CVE was the vulnerability exploited in that case. Detection opportunities Given the ongoing exploitation N-central described above, we recommend checking for evidence of API manipulation in the appliance logs, and auditing your user accounts to verify no unauthorized changes have been made to your users or their permissions. Huntress continues to monitor related activity and will update this post as more information becomes available. Update: 9/5/26 @ 5 PM ET Huntress is actively investigating a newly discovered authentication bypass affecting N-able N-central environments. Through rapid analysis of recent telemetry and partner-shared logs, our researchers have successfully reproduced and validated a proof of concept (PoC) that works against the latest N-Central version 2026.3.1.10. Following our discovery, we worked directly with N-able leadership and their security team to share our findings and tradecraft analysis, accelerating the development of an official fix. N-able has now released a security advisory and corresponding hotfix (2026.3.1.13), which we strongly urge all N-central administrators to apply immediately. This activity represents a net new exploit chain that potentially leverages one or both of two newly designated vulnerabilities ( CVE-2026-86206 and CVE-2026-86207 ), completely distinct from the flaws addressed by N-able's August hotfixes (CVE-2026-18556 and CVE-2026-18577). To be clear on our observations: Huntress' investigation began on September 4 after a customer's fully patched N-central production environment was compromised. While analyzing the intrusion, we successfully recreated an exploit chain that explains the observed adversarial activity. However, due to limited historical logging available directly on the appliance, we cannot definitively confirm which specific exploit the threat actor used to achieve their compromise, nor can we rule out the use of alternative vulnerabilities. Key tradecraft observations: Account name anomalies: We have observed attackers manipulating account names by appending unexpected strings (such as .invalid ) to known N-able email addresses during user creation attempts. Administrators should also watch for login names and email addresses with subtle character swaps or spoofed domains designed to pass casual inspection. Reconnaissance probes: Initial staging activity shows threat actors probing the /remoteControlAction.do?method=getPierDetails endpoint with specific appliance IDs to map the environment and gather details prior to exploitation. Disrupting adversary infrastructure In addition to our collaboration with N-able on the hotfix, Huntress has initiated direct communications with Cloudflare to proactively disable the adversary's existing tunnels. We assess that any exploitation activity that predates our discovery likely utilizes the same account token. By working with Cloudflare to take down this infrastructure, we aim to simultaneously shut these unauthorized backdoors across all affected environments. Detection opportunities Unlike the August campaign, which heavily abused the Take Control feature, this new activity targets the underlying API and appliance logs. Defenders should pivot their hunting efforts to the following files on their N-central servers: envoy_proxy_HTTPS.log syslog ncentraldms What to look for: API manipulation: Filter these logs for URL-encoded endpoint anomalies—specifically successful requests to internal API routes using URL-encoded values such as %2F . Account quirks: Audit newly created user accounts for unusual naming conventions, specifically email addresses appended with .invalid or similar unexpected string manipulations. Recommendations for N-central customers N-able has released a security advisory and a corresponding hotfix to address these vulnerabilities. Because this exploit chain grants full administrative control over user management, organizations must act immediately. Execute a rapid patching plan: Apply the latest N-central hotfix provided by N-able immediately. Refer to their official release notes and instructions to ensure your appliance is fully updated and no longer vulnerable. Hunt for anomalous user creation: Actively audit your user lists and access controls. Because this exploit chain grants full control over user management, you should hunt for any anomalous user c