[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzdoJxGPceR4u4yUsci8os-pIcAX1Tod2_Exs1S46hBM":3},{"article":4,"iocs":52,"watch_terms":62,"solutions":63,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"1eddcf21-ca72-47f9-9311-cbac693bbe62","N-able N-central Pre-Auth RCE Flaw Exploited in the Wild","n-able-n-central-pre-auth-rce-flaw-exploited-in-the-wild-4b40f1","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 11, 2026. The vulnerability in question is CVE-2026-86218 (CVSS score: 10.0), which has been described as a","CISA has added a critical pre-authentication remote code execution vulnerability (CVE-2026-86218) in N-able N-central to its Known Exploited Vulnerabilities catalog. The flaw, described as static code injection, has a CVSS score of 10.0 and requires federal agencies to patch by September 11, 2026. N-able has released a hotfix, and the vulnerability has reportedly been observed being exploited in the wild.","N-able N-central RCE vulnerability (CVE-2026-86218) added to CISA KEV catalog.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fn-able-n-central-pre-auth-rce-flaw.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhMxDWMjpVE5kkeTzvYQ-YAyekZZ6U6CzCYj462wNRwiMna-44-sJo8kY5Nz2-f_D1N7c0lkhR8Hr2BoAvsP6vVb7ea_R5s-UxdKkwnv6apOIM8sIxEoBRQXek7U5lrR0VaP9q_W8hFULVW7qyvskPiGvZN9wyC_FAUm23HdPcLw_wsmfU0-GoQ3PVkNNyJ\u002Fs1600\u002Fn-able.jpg","2026-09-09T04:27:51+00:00","2026-09-09T06:00:20.349861+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"N-able N-central","product",{"name":21,"type":22},"N-able","vendor",{"name":24,"type":19},"N-central 2026.3 Hotfix 4",{"name":26,"type":19},"N-central 2026.3 Hotfix 3",{"name":28,"type":19},"N-central","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57,60],{"type":54,"value":55,"context":56},"cve","CVE-2026-86218","Pre-authentication RCE vulnerability in N-able N-central",{"type":54,"value":58,"context":59},"CVE-2026-86206","Vulnerability allowing unauthenticated attacker to bypass authentication and create a new admin account",{"type":54,"value":61,"context":59},"CVE-2026-86207",[21,18,24],{"controls":64,"vendors":151},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":51,"name":124,"problem":125,"products":126},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[152],{"slug":153,"name":154,"logo_path":155,"roles":156},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png",[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":173},"critical-pre-auth-rce-in-n-able-n-central-actively-exploited","Critical Pre-Auth RCE in N-able N-central Actively Exploited","A maximum-severity (CVSS 10.0) pre-authentication remote code execution vulnerability in N-able N-central — a widely-used IT management platform — is being actively exploited in the wild, prompting CISA to add it to its Known Exploited Vulnerabilities catalog. Because it requires no authentication, attackers can gain full remote code execution without any valid credentials, making exposure of the management interface to the internet extremely dangerous. The static code injection flaw means that malicious input can be injected and executed at the server level, potentially compromising every managed endpoint downstream. This is particularly severe because N-central is used by managed service providers (MSPs), meaning a single compromise can cascade into hundreds of customer environments. Federal agencies have been mandated to patch by September 11, 2026, but all organizations should treat this as an emergency requiring immediate action.",[163,164,165,166,167,168,169,170,171,172],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 SC-7: Boundary Protection","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF RS.MI-3: Newly Identified Vulnerabilities Mitigated","CISA KEV Catalog Binding Operational Directive (BOD) 22-01","ITIL 4: Change Enablement (Emergency Change Procedures)",{}]