Pre-authentication remote code execution in N-able N-central RMM (CVE-2026-86218)
VulnCheck added this pre-auth RCE to its known-exploited catalog on 2026-09-06 citing N-able's own status event, and an unpatched N-central server is a single hop to every endpoint it manages.
N-central servers before 2026.3.1.14 allow an unauthenticated remote attacker to execute code on the server. Because N-central is a remote monitoring and management platform, compromise of the server exposes every managed endpoint to follow-on actions.
Affected: N-able N-central < 2026.3.1.14
How to Test
Check the installed N-central version in the server administration console; any build below 2026.3.1.14 is vulnerable. Review web-server access logs for unexpected requests to the N-central web interface from unknown IPs, and audit N-central for administrator accounts, scripts, or automation policies you do not recognise.
How to Patch
Upgrade N-central to 2026.3.1.14 or later. Until upgraded, restrict access to the N-central web interface to trusted networks or a VPN, and after upgrading review the server and managed devices for unexpected accounts, scheduled tasks, or scripts.