N-able N-central Static Code Injection Vulnerability Added to CISA KEV
CISA KEV · 3 sources
What's on the official record
CISA added CVE-2026-86218 to the Known Exploited Vulnerabilities Catalog. The vulnerability is a static code injection issue in N-able N-central that could allow pre-authentication remote code execution. CISA records the dateAdded as 8 September 2026 and the remediation due date for federal civilian agencies as 11 September 2026. The catalog version is 2026.10.21, and the catalog does not record known ransomware use.
The CVE record classifies this as CWE-96 and names version 2026.3.1.14 as the first fixed version, meaning earlier versions are affected. FIRST's EPSS model estimates exploitation probability at 0.133 (96th percentile, 23 October 2026). CISA's ADP assesses exploitation as active, automatable, with total impact.
Assessment
For a platform or AI-stack owner, the record gives a fixed version to check against: N-central instances below 2026.3.1.14 are affected. You can verify which version you run and apply the vendor's mitigations or move to 2026.3.1.14 before an unauthenticated remote code execution path is exercised against you.
For a cyber underwriter, the record establishes an actively exploited, automatable pre-authentication remote code execution vulnerability in a remote management product, with CISA setting a federal due date of 11 September 2026. You can ask a policyholder whether its N-central deployment is below 2026.3.1.14 and what patching evidence it holds.
For a deal team, the record flags a known exploited vulnerability in a target's or counterparty's remote management tooling. You can scope diligence to whether any N-central instances in the target are below 2026.3.1.14 and whether remediation was completed by CISA's due date.
What would change this call
The call changes if the vendor publishes a further advisory altering the fixed version, if CISA revises the due date, or if a later catalog version records ransomware use for this CVE. It also changes if the affected version range is shown to be broader or narrower than stated.
What to check next
| Check | Why it matters |
|---|---|
| Confirm the N-central version in the environment | Determines whether the fixed version 2026.3.1.14 applies |
| Verify patching was applied by 11 September 2026 | The record names a federal remediation due date |
| Watch for a catalog update that records ransomware use | Currently the catalog records no known ransomware use |
Confidence
This note is drawn from the CISA Known Exploited Vulnerabilities Catalog entry and the CVE record, both primary sources. FIRST's EPSS model estimate and CISA's ADP SSVC assessment are attributed as such. Filed 23 October 2026 from the record dated 8 September 2026.
Sources
[1] N-able N-central Static Code Injection Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-86218
[2] CVE record CVE-2026-86218 — https://www.cve.org/CVERecord?id=CVE-2026-86218
[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog