CVE-2026-86218

CRITICAL9.8

CISA KEV

Published 2026-09-06 · Updated 2026-09-09 · Source a5532a13-c4dd-4202-bef1-e0b8f2f8d12b

Summary

CVE-2026-86218 is a critical-severity (CVSS 9.8) vulnerability in N-able N-central. CISA added it to the Known Exploited Vulnerabilities catalog on September 8, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 11, 2026. CISA does not currently list it as used in ransomware campaigns. N-able has 5 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 5 known-exploited N-able vulnerabilities →

Description

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-96

CISA Known-Exploited Vulnerability

Product: N-able — N-central

Name: N-able N-central Static Code Injection Vulnerability

Date added: 2026-09-08 · Due: 2026-09-11

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

View on NVD

More exploited N-able vulnerabilities

Most recently added to CISA KEV

CVE-2026-18556
N-central — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
added 2026-08-04
CVE-2026-18577
N-central — N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
added 2026-08-03
CVE-2025-8876
N-Central — N-able N-Central Command Injection Vulnerability
added 2025-08-13
CVE-2025-8875
N-Central — N-able N-Central Insecure Deserialization Vulnerability
added 2025-08-13

View all →

Related CVEs

Same severity, most recent

CVE-2026-115931
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
2026-10-23 · score 9.9
CVE-2026-115893
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
2026-10-23 · score 9.9
CVE-2026-115889
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
2026-10-23 · score 9.9
CVE-2026-115812
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
2026-10-23 · score 9.8
CVE-2026-55486
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.
2026-10-23 · score 9.3