How to find N-able N-central installations on your network

Latest N-able N-central vulnerabilities: CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218 #

N-able has disclosed three vulnerabilities in certain versions of N-central.

• CVE-2026-86206: An access control bypass vulnerability in the internal API access control filter allows a remote, unauthenticated attacker to obtain unauthorized access to internal APIs. The vulnerability has been designated CVE-2026-86206 and has been rated medium with a CVSS score of 6.9.
• CVE-2026-86207: An authentication bypass vulnerability in the internal API allows a remote, low-privileged attacker to obtain unauthorized privileges. The vulnerability has been designated CVE-2026-86207 and has been rated high with a CVSS score of 7.7.
• CVE-2026-86218: A pre-authentication remote code execution (RCE) vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the target server. The vulnerability has been designated CVE-2026-86218 and has been rated critical with a CVSS score of 10.0.

There is evidence that CVE-2026-86218 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 8, 2026.

The following versions are affected

• N-Central: Versions prior to 2026.3 Hotfix 4 (Build 2026.3.1.14)

Note: CVE-2026-86218 is resolved in 2026.3 Hotfix 4 (Build 2026.3.1.14), which supersedes 2026.3 Hotfix 3 (Build 2026.3.1.13) (the patch for CVE-2026-86206 and CVE-2026-86207).

What is N-Able N-Central? #

N-able N-central is an enterprise remote monitoring and management (RMM) software platform used by managed service providers (MSPs) and internal IT teams to discover, automate, patch, and secure network infrastructure and endpoints across Windows, macOS, Linux, and cloud environments.

What is the impact? #

Successful exploitation of this vulnerability would allow a remote, unauthenticated attacker to execute arbitrary commands on the target server, potentially enabling persistent lateral movement and unauthorized command execution across managed downstream endpoints.

Are any updates or workarounds available? #

Users are encouraged to update to the latest version as quickly as possible:

• N-central 2025.4.x through 2026.3.x: Upgrade to version 2026.3 Hotfix 4 (Build 2026.3.1.14) or later.
• Legacy and Unsupported Versions: Upgrade to a supported release pathway, then apply version 2026.3 Hotfix 4 (Build 2026.3.1.14).

How to find potentially vulnerable systems with runZero #

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="N-able" AND product:="N-central" AND source:runzero

August 2026: CVE-2026-18556 and CVE-2026-18577 #

N-able has disclosed two vulnerabilities in certain versions of N-central. Certain versions of N-Central are affected by multiple authentication bypass vulnerabilities.

• CVE-2026-18556: Initial authentication bypass via an alternate path or channel. The vulnerability has been designated CVE-2026-18556 and has been rated high with a CVSS score of 8.2.
• CVE-2026-18577: Secondary authentication bypass resulting from an incomplete patch for CVE-2026-18556. The vulnerability has been designated CVE-2026-18577 and has been rated high with a CVSS score of 8.2.

Successful exploitation allows a remote, unauthenticated attacker to bypass authentication and obtain administrative account access on the server. Administrative access may allow attackers to execute unauthorized commands or establish persistence across managed downstream endpoints.

There is evidence that CVE-2026-18577 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 3, 2026.

Update (August 4, 2026): There is evidence that CVE-2026-18556 is being actively exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on August 4, 2026.

The following versions are affected

• N-Central: Versions prior to 2026.3.1 Hotfix 1 (Build 2026.3.1.7)

What is N-Able N-Central? #

N-able N-central is an enterprise remote monitoring and management (RMM) software platform used by managed service providers (MSPs) and internal IT teams to discover, automate, patch, and secure network infrastructure and endpoints across Windows, macOS, Linux, and cloud environments.

What is the impact? #

Successful exploitation of these vulnerabilities would allow a remote, unauthenticated attacker to bypass authentication and obtain administrative access on the server, potentially enabling unauthorized command execution and persistent lateral movement across managed downstream endpoints.

Are any updates or workarounds available? #

Users are encouraged to update to the latest version as quickly as possible:

• N-central 2026.3.x, 2026.2.x, 2026.1.x, and 2025.4.x: Upgrade to version 2026.3.1 Hotfix 1 (Build 2026.3.1.7) or later.
• Legacy & Unsupported Versions: Upgrade to a supported release pathway, then apply version 2026.3.1 Hotfix 1 (Build 2026.3.1.7).

How to find potentially vulnerable systems with runZero #

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="N-able" AND product:="N-central"

September 2025: CVE-2025-8875 and CVE-2025-8876 #

N-able has disclosed two vulnerabilities in certain versions of N-central. There is evidence that these vulnerabilities are being actively exploited in the wild.

• A deserialization of untrusted data vulnerability allows a remote, low-privileged adversary to execute arbitrary code on the system. This vulnerability has been designated CVE-2025-8875 and has been rated critical with a CVSS score of 9.4.
• An improper input validation vulnerability allows a remote, low-privileged adversary to execute arbitrary OS commands on the system. This vulnerability has been designated CVE-2025-8876 and has been rated critical with a CVSS score of 9.4.

The following versions are affected

• N-central versions prior to 2025.3.1

What is the impact? #

Successful exploitation of these vulnerabilities would allow an adversary to execute arbitrary code on the vulnerable host, potentially leading to complete system compromise.

Are updates or workarounds available? #

Users are encouraged to update to the latest version as quickly as possible:

• N-central upgrade to version 2025.3.1 or later

How to find potentially vulnerable systems with runZero #

From the Software Inventory, use the following query to locate potentially impacted assets:

vendor:="N-able" product:="N-central"