Description
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
Published: 2026-09-06
Score: 10 Critical
EPSS: 13.3% Moderate
KEV: Yes
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

N-central is vulnerable to a pre‑authentication remote code execution flaw. The issue allows an attacker to execute arbitrary code on the system before authentication is performed. This flaw falls under CWE‑96 and has a CVSS score of 10.

Affected Systems

The flaw applies to N‑able N‑central installations running a version before 2026.3.1.14, including the 2026.3 releases and earlier hotfix builds. Users of these versions are at risk unless they upgrade to 2026.3.1.14 or newer.

Risk and Exploitability

The CVSS score of 10 indicates critical severity. The EPSS score of 15% suggests a moderate likelihood of exploitation. The vulnerability is listed in CISA’s KEV catalog, indicating active exploitation. Based on the description, it is inferred that the attack vector is remote and does not require prior authentication. Consequently, the attack can be launched from outside the organization.

Generated by OpenCVE AI on October 9, 2026 at 15:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest N-central release (2026.3.1.14 or newer) to address the pre‑authentication‑96.
  • Restrict external access to the N‑central management interface using firewall rules or network segmentation to limit exposure.
  • Monitor network and application logs for suspicious requests that may indicate attempts to exploit the vulnerability.

Generated by OpenCVE AI on October 9, 2026 at 15:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*
cpe:2.3:a:n-able:n-central:2026.3:-:*:*:*:*:*:*
cpe:2.3:a:n-able:n-central:2026.3:hotfix1:*:*:*:*:*:*
cpe:2.3:a:n-able:n-central:2026.3:hotfix2:*:*:*:*:*:*
cpe:2.3:a:n-able:n-central:2026.3:hotfix3:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Tue, 08 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-09-08T00:00:00+00:00', 'dueDate': '2026-09-11T00:00:00+00:00'}

Mon, 07 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 06 Sep 2026 04:15:00 +0000

Type Values Removed Values Added
First Time appeared N-able
N-able n-central
Vendors & Products N-able
N-able n-central

Sun, 06 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Description N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
Title pre-authentication remote code execution
Weaknesses CWE-96
References
Metrics cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

N-able N-central
cve-icon MITRE

Status: PUBLISHED

Assigner: N-able

Published:

Updated: 2026-09-09T04:25:45.576Z

Reserved: 2026-09-05T22:34:40.390Z

Link: CVE-2026-86218

cve-icon Vulnrichment

Updated: 2026-09-07T10:54:55.800Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-06T03:17:17.373

Modified: 2026-09-09T05:18:19.490

Link: CVE-2026-86218

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T15:45:07Z

Weaknesses
  • CWE-96

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')