Critical N-able N-central Vulnerability and Active Exploitation

What it is

Two follow-up updates (9/5/26 and 9/6/26) to the Huntress N-central post covering net-new vulnerabilities distinct from the August CVE-2026-18556/18577 chain described in the existing summary. On 9/5, Huntress disclosed a new authentication bypass exploit chain leveraging CVE-2026-86206 and/or CVE-2026-86207, reproduced against N-central 2026.3.1.10, fixed in hotfix 2026.3.1.13 (HF3). On 9/6, a third independent researcher reported CVE-2026-86218, a pre-auth remote code execution flaw rated CVSS 10.0, fixed in 2026.3 HF4, which supersedes HF3. N-able's Jason Murphy explicitly called CVE-2026-86218 "a Zero day."

How it works

The 9/5 chain is an authentication bypass; Huntress validated a working PoC against 2026.3.1.10. Unlike the August campaign (which abused the Take Control feature), this activity targets the underlying API and appliance logs. Observed tradecraft:

• Account name anomalies — attackers append strings like .invalid to known N-able email addresses when creating users, plus subtle character swaps / spoofed domains.
• Reconnaissance — probing /remoteControlAction.do?method=getPierDetails with specific appliance IDs to map the environment before exploitation.

CVE-2026-86218 allows pre-authenticated access to the N-central server.

Preconditions / Affected

On-premises N-central environments. Notably, fully patched systems were compromised — Huntress's investigation began 9/4 after a customer's patched production environment was breached. Hosted N-central instances have already been patched by N-able (no action needed).

What to do

• On-prem: upgrade to 2026.3 HF4 immediately. If already on HF3, you still must move to HF4 for CVE-2026-86218.
• Check appliance logs for evidence of API manipulation.
• Audit user accounts for unauthorized changes to users or permissions, watching for .invalid-suffixed or spoofed email/login names.
• Hunt for the getPierDetails recon endpoint activity.
• Note Huntress worked with Cloudflare to disable adversary tunnels, assessing prior exploitation reused the same account token.

Caveats

• Conflicting exploitation claims: MSPGeek and N-able's Active Incident page say CVE-2026-86218 was exploited in the wild, but N-able's Release Notes state "we have no confirmations that this vulnerability has been exploited in production environments."
• Huntress cannot confirm which specific vulnerability caused the 9/4 compromise — appliance logs had rotated, so they cannot attribute it to the August CVEs, the 9/5 CVEs, or CVE-2026-86218.
• Which of CVE-2026-86206 vs. CVE-2026-86207 the exploit chain relies on is not pinned down ("one or both").