Affected Systems
N-able N-central on-premises deployments prior to version 2026.3 Hotfix 4. Approximately 1,500 instances exposed online, primarily in the US and Europe. Used by IT departments and MSPs for remote monitoring and management.
Exploitation Status
Active exploitation confirmed. Huntress identified evidence of compromise in at least one production environment, though specific CVE attribution unclear due to log rotation. N-able states unpatched systems remain at risk. Two related authentication bypass flaws (CVE-2026-86206, CVE-2026-86207) also patched simultaneously.
Business Impact
Maximum severity RCE allows unauthenticated attackers to execute arbitrary code on exposed N-central servers with low attack complexity. Compromise of RMM platforms grants attackers privileged access to all managed client networks and devices, enabling supply chain attacks against MSP customers. Historical N-able patching compliance is poor (880 servers remained vulnerable weeks after 2025 zero-days).
Urgency
🔴 Immediate
Recommended Actions
- Upgrade all on-premises N-able N-central instances to version 2026.3 Hotfix 4 immediately
- Audit N-central access logs for suspicious authentication attempts or code execution between September 5-7, 2026 (if logs available)
- Verify N-central instances are not directly exposed to the internet; implement VPN or IP allowlisting if remote access required
- Monitor for lateral movement from N-central servers to managed endpoints and review recent configuration changes or agent deployments
- If immediate patching is not possible, temporarily isolate N-central servers from internet access until hotfix can be applied