N-able released its fourth hotfix in five weeks for its N-central remote monitoring and management platform, this time for a flaw that gives an unauthenticated attacker full "god-mode" access to the console. Tracked as CVE-2026-86218 and scored 10.0, the pre-authentication remote code execution zero-day is being exploited and supersedes all earlier hotfixes, so on-premises systems still on the third hotfix remain vulnerable and must apply the fourth. Hosted instances have already been patched. Researchers also disclosed a separate chain that lets attackers bypass access controls to create unauthorized administrator accounts. Because N-central manages many downstream endpoints, a compromise can cascade across every customer it serves.
N-able is warning that attackers exploited an authentication bypass in N-central, the remote monitoring and management platform used by managed service providers and IT teams to administer customer endpoints. The flaw, CVE-2026-18556, allows unauthenticated administrative account takeover, and N-able's initial fix in one release proved incomplete: it found another way to exploit the same weakness, tracked as CVE-2026-18577, that widened the affected range. After taking over a server, attackers used its remote-control feature to reach managed endpoints and installed Cloudflare tunnels as services, which kept access alive even after the route through the N-central server was cut. Build 2026.3.1.7 is the first unaffected version.
TrustStrike Labs