Monday, September 7, 2026 — The Exploit Bulletin

Remote Code ExecutioncriticalCVSS 10.0 CVE-2026-86218

Pre-authentication remote code execution in N-able N-central RMM (CVE-2026-86218)

VulnCheck added this pre-auth RCE to its known-exploited catalog on 2026-09-06 citing N-able's own status event, and an unpatched N-central server is a single hop to every endpoint it manages.

N-central servers before 2026.3.1.14 allow an unauthenticated remote attacker to execute code on the server. Because N-central is a remote monitoring and management platform, compromise of the server exposes every managed endpoint to follow-on actions.

Affected: N-able N-central < 2026.3.1.14

How to Test

Check the installed N-central version in the server administration console; any build below 2026.3.1.14 is vulnerable. Review web-server access logs for unexpected requests to the N-central web interface from unknown IPs, and audit N-central for administrator accounts, scripts, or automation policies you do not recognise.

How to Patch

Upgrade N-central to 2026.3.1.14 or later. Until upgraded, restrict access to the N-central web interface to trusted networks or a VPN, and after upgrading review the server and managed devices for unexpected accounts, scheduled tasks, or scripts.

Evidence: VulnCheck KEV ↗

Vendor Advisory: link ↗

Sources: VulnCheck KEV ↗, NVD ↗

Permalink: /bulletin/2026-09-07/pre-authentication-remote-code-execution-in-n-able-n-central-rmm-cve-2026-86218

Privilege EscalationcriticalCVSS 9.2 CVE-2026-86060 CVE-2026-67276 CVE-2026-67277

Unauthenticated SSH login-path flaw changes RouterOS policy mask for full device takeover in MikroTik RouterOS (CVE-2026-86060)

CERT Polska and Italy's CSIRT both reported active exploitation of the MikroTrick RouterOS flaws within the last two days, and a router with SSH reachable from untrusted networks and still on an unfixed release can be taken over without credentials.

An argument-handling flaw in the RouterOS SSH login helper, triggered by usernames beginning with a prohibited character, lets an attacker with only an unauthenticated SSH session alter the trusted RouterOS policy mask and escalate to full control of the router. It is one of three related flaws (with CVE-2026-67276 and CVE-2026-67277) that MikroTik groups under the codename MikroTrick.

Affected: MikroTik RouterOS >= 7.24 < 7.24.2; MikroTik RouterOS >= 7.0.0 < 7.23.4; MikroTik RouterOS >= 6.0.0 < 6.49.21

How to Test

Check the running RouterOS version under System/Packages; anything below 6.49.21 (v6), 7.23.4 (7.x long-term) or 7.24.2 (7.24 stable) is vulnerable. Check whether SSH is reachable from untrusted networks. Inspect the Log section for a critical entry stating the device has been Flagged, and review the configuration for unknown scripts, users, or other settings you do not recognise.

How to Patch

Upgrade via System/Packages > Check For Updates to 6.49.21 (long-term v6), 7.23.4 (long-term v7), 7.24.2 (stable) or 7.25 beta 3; MikroTik notes the v6 branch is no longer actively developed and recommends moving to v7. Make a backup/export first. Independently, ensure SSH is not open to untrusted networks, restrict it to trusted IPs, or reach the router only over a VPN such as WireGuard. If the device shows Flagged status, follow MikroTik's Flagged status documentation; after upgrading, remove any unknown scripts, users, or configuration.

Evidence: VulnCheck KEV ↗, CERT Polska: critical RouterOS vulnerabilities actively exploited, immediate update recommended ↗, ACN / CSIRT Italia alert AL01/260906: exploitation of new MikroTik vulnerabilities observed in the wild ↗, Public exploit ↗

Vendor Advisory: link 1 ↗, link 2 ↗, link 3 ↗, link 4 ↗

Sources: VulnCheck KEV ↗, NVD ↗, NVD ↗, NVD ↗

Permalink: /bulletin/2026-09-07/unauthenticated-ssh-login-path-flaw-changes-routeros-policy-mask-for-cve-2026-86060