CVE-2026-86218 is a remote code execution vulnerability in N-able's N-central RMM platform that allows threat actors without privileges to execute arbitrary code on internet-exposed instances. N-able released an emergency hotfix (N-central 2026.3 Hotfix 4) to address this maximum-severity flaw and urged customers to upgrade immediately. The vulnerability is exploitable with low complexity and affects on-premises deployments. Additional related authentication bypass vulnerabilities (CVE-2026-86206 and CVE-2026-86207) were patched simultaneously. Although no confirmed active exploitation in production environments is reported, the presence of nearly 1,500 exposed servers increases risk. Security researchers flagged this as a potential zero-day. Systems running the previous hotfix remain vulnerable until updated to HF4.

The vulnerability allows unauthenticated remote attackers to execute arbitrary code on vulnerable N-central servers, potentially leading to full compromise of the management platform. This could enable attackers to control managed client networks and devices. The flaw is rated maximum severity due to its remote code execution nature and low attack complexity. The presence of exposed servers on the internet increases the risk of exploitation. No confirmed exploitation in production has been reported yet, but unpatched systems remain at risk.

N-able has released an official hotfix (N-central 2026.3 Hotfix 4) that fully addresses the vulnerability. Customers running on-premises N-central deployments should apply this hotfix immediately. Systems running earlier versions or previous hotfixes remain vulnerable and must be upgraded without delay. No additional mitigation steps are indicated beyond applying the official patch.