Small Town Sysadmin
Free CJIS checklist

Useful tools

Security alert

Patch N-able N-central to 2026.3 Hotfix 4: pre-authentication code execution

A critical flaw can let an attacker run code on an on-premises N-central server without logging in. CISA added it to its exploited list on September 8. Hosted customers are already patched.

If you run N-able N-central on your own server, upgrade to 2026.3 Hotfix 4 (build 2026.3.1.14) now. The flaw could let an attacker run code on the N-central server before logging in, and since N-central manages every device it’s connected to, a compromised server is a direct path into every client network.

The details

  • CVE: CVE-2026-86218, rated critical by N-able
  • Impact: pre-authentication remote code execution on the N-central server
  • Fixed in: N-central 2026.3 Hotfix 4, build 2026.3.1.14
  • Exploitation: N-able’s notice (updated September 5) said it had no confirmation of exploitation at that point. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 8, which means there is now evidence of exploitation.

What to do

Hosted N-central (NCOD): N-able has already applied the patch. No action needed.

Self-hosted N-central:

  1. Upgrade to 2026.3.1.14. You can upgrade directly from 2025.4, 2026.1, 2026.2, 2026.3, or 2026.3 Hotfix 1 or 2.
  2. On an older version? Move to one of those builds first, then to the hotfix. N-able support can help plan the path.
  3. Agents: the hotfix protects you without agent updates, but N-able recommends keeping agents current as a best practice.

After patching, it’s worth reviewing N-central user accounts and recent activity for anything you don’t recognize, especially if the server was reachable from the internet before the update.

Sources

All articles