CVE-2026-86218: N-central RCE Fix and MSP Checks

Checked November 10, 2026. CVE-2026-86218 is a pre-authentication remote code execution vulnerability in N-able N-central. N-able’s September security guidance identifies N-central 2026.3 Hotfix 4, build 2026.3.1.14, as the first documented correction. The October 2026.4 release includes the same mitigation, and N-able’s November 2 2026.4 HF1 release notes list build 2026.4.0.32 as the current release, superseding 2026.4.0.27. If a self-hosted server is on an older build, verify and follow the supported upgrade path. Do not use agent update status as proof that the management server is fixed.

Sources: N-able’s HF4 security notice, 2026.4 release notes, 2026.4 HF1 release notese o CVE record. This is a version and evidence guide, not a Penligent exploitation test.

Which N-central build should MSPs verify?

The release line matters. N-able documents CVE-2026-86218 as fixed in 2026.3.1.14, and its 2026.4 release says that it includes the same mitigation. The later 2026.4 HF1 release supersedes 2026.4.0.27. N-able also says that an instance already successfully upgraded to 2026.4.0.31 does not need to move to .32 solely for the HF1 change; .32 accommodates servers with a named performance code drop. Record what is running and follow the vendor’s exact guidance rather than comparing version strings from different branches.

For N-central 2026.4 HF1, N-able lists direct upgrade paths from 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1–4, and 2026.4 build 2026.4.0.27. Earlier builds require an intermediate supported version. Confirm the actual starting build and use the current N-central upgrade guide.

How the related CVE trend terms map to the HF1 release

Related queries can point to a platform update without meaning that every named CVE affects N-central. The 2026.4 HF1 notes say that the AlmaLinux 9 update includes fixes for CVE-2026-98432 and CVE-2026-111497, and removes trust for affected eMudhra-signed chains under CVE-2026-114406. N-able explicitly says N-central does not use the Brotli decoder involved in CVE-2026-111497 and is not vulnerable to that issue. The eMudhra CVE named by this release is CVE-2026-114406; do not conflate it with a different identifier such as CVE-2026-114820 from a separate search query. These are distinct issues from N-central’s own CVE-2026-86218.

Reconcile the original notice with CISA KEV

N-able’s September 6 notice said it had no confirmation of production exploitation at that time. The CISA KEV feed currently records CVE-2026-86218 as added September 8, 2026, with a September 11 due date and forensic triage required. Those statements refer to different observation dates. KEV listing supports treating the vulnerability as known exploited; it does not prove that a particular MSP instance was compromised.

CISA’s BOD 26-04 requirements apply to the federal agencies and systems within its scope. Other organizations should set an accountable remediation deadline using exposure, contractual duties and their own risk process instead of treating the federal due date as a universal legal mandate.

Build an MSP impact and closure record

Use this blank template per N-central instance. It is a planning aid, not customer test evidence. Keep sensitive customer identifiers in the controlled incident system.

instance_id:
service_owner_and_hosting_model:
active_server_build_and_observation_time:
untrusted_reachability:
managed_tenant_inventory_reference:
vendor_correction_and_change_reference:
post_upgrade_health:
incident_review_reference:
exception_owner_and_expiry:

Keep patch closure separate from incident review. A corrected active build supports remediation under vendor conditions; it does not prove that earlier activity was legitimate or that credentials remained safe. For a previously exposed server, preserve available authentication, administrative-change, server and network records through approved procedures. Escalate unexplained privileged accounts or management actions through the incident owner and N-able support.

Frequently asked questions

Does updating every N-central agent close CVE-2026-86218?

No. The fix applies to the N-central server. Agent maintenance is separate evidence.

Is 2026.3.1.13 the corrected build?

No. N-able identifies 2026.3.1.14 as Hotfix 4; 2026.3.1.13 was Hotfix 3.

Does the CVE-2026-111497 search trend mean N-central is vulnerable?

No. N-able says N-central does not use the affected Brotli decoder. Its HF1 release includes the dependency update as routine security maintenance.

Can self-hosted operators rely on the hosted-service statement?

No. Hosted instances are upgraded by N-able; self-hosted operators must verify their own server build and change record.

For a separate authorized application assessment, Penligent’s sample pentest report illustrates evidence and retest fields. It does not certify an N-central instance or replace the vendor correction.