N-able N-central Pre-Auth RCE Flaw Exploited in the Wild

A maximum-severity (CVSS 10.0) pre-authentication remote code execution vulnerability in N-able N-central — a widely-used IT management platform — is being actively exploited in the wild, prompting CISA to add it to its Known Exploited Vulnerabilities catalog. Because it requires no authentication, attackers can gain full remote code execution without any valid credentials, making exposure of the management interface to the internet extremely dangerous. The static code injection flaw means that malicious input can be injected and executed at the server level, potentially compromising every managed endpoint downstream. This is particularly severe because N-central is used by managed service providers (MSPs), meaning a single compromise can cascade into hundreds of customer environments. Federal agencies have been mandated to patch by September 11, 2026, but all organizations should treat this as an emergency requiring immediate action.