N-able has released an emergency hotfix for N-central, its remote monitoring and management platform used by IT departments and managed service providers to centrally administer client networks and endpoints. The flaw, tracked as CVE-2026-86218, carries a maximum CVSS score and allows unauthenticated attackers to execute arbitrary code on exposed N-central servers in low-complexity attacks. This is N-able’s fourth hotfix in five weeks for N-central — a tempo that reflects both the severity of the vulnerabilities being found and the difficulty of fully closing them. MSPs are high-value targets precisely because a single compromised N-central server provides access to every endpoint it manages across all of an MSP’s clients.
The new release, N-central 2026.3 Hotfix 4, also patches CVE-2026-86206 and CVE-2026-86207, a pair of high-severity authentication bypass flaws that together allow attackers to skip authentication entirely and gain full administrative access to a vulnerable platform. N-able says it has no confirmed reports of CVE-2026-86218 being exploited in production environments, but security firm Huntress has assessed it as a potential zero-day being actively investigated and rates the overall risk as critical. The Shadowserver Foundation is currently tracking approximately 1,500 N-central servers with internet-facing exposure, the majority in the United States and Europe.
How to check if you’re affected
Affected versions are all N-central builds prior to 2026.3 Hotfix 4. Administrators can confirm their current version from the N-central console’s “About” section. If your N-central instance is reachable from the internet without a VPN, you should treat this as a critical priority and apply Hotfix 4 immediately — Shadowserver’s scan shows approximately 1,500 such exposed servers. Also review N-able’s previously published guidance on Cloudflare tunnel persistence: attackers in earlier N-central incidents installed Cloudflared services on managed endpoints that survived server-level patches, so upgrading N-central alone may not fully remove persistence on already-compromised devices.