### Critical RCE Vulnerability Discovered **N-able** has rolled out an emergency hotfix to address a critical remote code execution (RCE) vulnerability, **CVE-2026-86218**, impacting its **N-central** RMM platform. The platform is widely used by IT departments and managed service providers (MSPs) to oversee client networks and devices from a central web-based console. This high-severity flaw enables unprivileged attackers to execute malicious code on internet-exposed **N-central** instances with low-complexity attacks. **N-able** responded swiftly, releasing **N-central 2026.3 Hotfix 4** on Saturday and urging all customers to patch without delay. "At this time, we have no confirmations that this vulnerability has been exploited in production environments, but unpatched systems remain at risk," **N-able** stated. "Customers running on-premises **N-central** deployments should upgrade to **N-central 2026.3 HF4** immediately to protect their environment." The **Shadowserver Foundation**, an internet security nonprofit, reports nearly 1,500 **N-central** servers currently exposed online, with a significant concentration in the United States and Europe.  ### Evidence of Potential Active Exploitation While **N-able** has not yet confirmed in-the-wild exploitation of **CVE-2026-86218**, cybersecurity firm **Huntress** has flagged it as a potential zero-day. This follows the patching of two other high-severity vulnerabilities, **CVE-2026-86206** and **CVE-2026-86207**, earlier in the weekend. These two flaws could allow attackers to bypass authentication and gain full access to vulnerable **N-central** platforms. **Huntress** noted, "In our 9/5/26 update [...], we had said we could not rule out whether the two previous vulnerabilities released (**CVE-2026-86206** and **CVE-2026-86207**) were the ones that were exploited in the instance seen in the patched production environment of one of our customers." They added, "Because logs on the compromised **N-central** server had already rotated, we are also unable to say whether this new **CVE** was the vulnerability exploited in that case." **Huntress** strongly advised, "On-premises **N-central** users must apply **HF4** immediately, as systems running **HF3** remain vulnerable to this newly disclosed flaw." This incident echoes a situation from a year ago when **N-able** released security updates for **N-central** vulnerabilities (**CVE-2025-8875** and **CVE-2025-8876**) that were actively being exploited. Despite warnings from **CISA** and broad industry alerts, **Shadowserver** later found over 800 **N-central** servers still unpatched against those critical flaws, highlighting the persistent challenge of timely patching.