CISA Adds Critical N-able N-central Flaw to KEV; Hotfix 4 Available

N-central Hotfix 4 addresses the critical CVE-2026-86218 vulnerability in the N-able N-central tool. On September 8, 2026, the U.S. agency CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, which collects vulnerabilities considered to be exploited. The flaw could allow remote code execution on a server without prior authentication.

N-able says that N-central versions older than build 2026.3.1.14 are affected. The vendor therefore released N-central 2026.3 Hotfix 4, designated as build 2026.3.1.14. It recommends that organizations with their own, meaning on-premises, deployments update immediately. Hosted NCOD instances have already received the fix, according to N-able.

N-central Hotfix 4 for on-premises servers

N-central is a remote monitoring and management (RMM) platform used by administrators and IT service providers to monitor and manage devices. A vulnerability on such a server is more severe partly because an RMM system may manage a large number of customer devices.

If CVE-2026-86218 were successfully exploited, an attacker could execute code on an N-central server without authentication. In its notice, N-able identified fixed build 2026.3.1.14 as the cutoff for affected versions. For administrators of their own installations, the specific step is therefore to deploy Hotfix 4, not merely check the product’s general version.

When adding the flaw to KEV, CISA refers to following the vendor’s instructions. The catalog is intended for flaws for which the agency has sufficient basis to designate them as being exploited in the wild.

Communication about exploitation is not entirely consistent

The exploitation status of CVE-2026-86218 is accompanied by a discrepancy in the currently available communications. N-able’s Hotfix 4 release notes from September 5 and 6 stated that the company had no confirmed exploitation of the vulnerability in production environments.

However, the Canadian Centre for Cyber Security states in its alert that N-able indicates exploitation of the flaw in the wild. Its subsequent addition to the CISA KEV catalog further underscores this status. However, the available information does not publicly confirm the number of affected organizations or the identities of specific attackers.

Researchers from Huntress also pointed out limitations in the retrospective analysis of an earlier compromise. Due to a lack of historical logs, they could not conclusively attribute it specifically to CVE-2026-86218. This circumstance does not refute the flaw’s inclusion in KEV, but it means that the public technical attribution of individual incidents is not settled.

What administrators should do

• Verify whether the organization’s own N-central server is running build 2026.3.1.14 or newer.
• If an older version is deployed, promptly apply N-central Hotfix 4 according to N-able’s instructions.
• Examine the environment for possible prior compromise, since installing the fix alone does not rule it out.
• Monitor further notices from N-able, CISA, and trusted security researchers, especially any indicators of compromise and forensic guidance.

An updated N-able statement on confirmed exploitation in production and the possible release of additional technical details can be expected in particular. The scope of the incidents and attribution of the attacks to a specific actor have not yet been publicly confirmed.

Verified and updated: 09. 09. 2026 06:22