A CVSS 10 in the Tool That Manages Everything Else

N-able has patched CVE-2026-86218, a static code injection flaw rated CVSS 10.0 that gives pre-authentication remote code execution in N-central, after confirming it has been observed being exploited in the wild. Versions prior to 2026.3 Hotfix 4 are affected; the hotfix was released on 5 September. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 8 September with a remediation deadline of 11 September for federal civilian agencies. Huntress reported finding a fully patched customer environment compromised on 4 September, though the specific exploit used remains unconfirmed. Two earlier issues fixed in Hotfix 3, CVE-2026-86206 and CVE-2026-86207, could be chained to bypass authentication and create attacker-controlled system administrator accounts.

The reason this belongs in an industrial publication rather than only an IT one is the position N-central occupies. It is a remote monitoring and management platform used by managed service providers and large IT organisations to administer entire customer estates, which means it holds agent connectivity and administrative credentials into every machine it manages. Compromising it does not yield one network; it yields all of them. That property is why RMM platforms have become a preferred target for ransomware operators, and it is the same structural weakness seen in the firewall management and edge management advisories of the past fortnight — the management plane is a higher-value target than anything it manages.

For industrial operators the specific exposure is often indirect and therefore easy to miss. Many plants do not run N-central themselves; their IT support provider does, and the agent is installed on engineering workstations, historians, HMI panel PCs and the machines that bridge the business and process networks. A compromise at the provider therefore arrives inside the plant with legitimate credentials and an agent that is permitted to execute code, which defeats most perimeter controls by design.

The action is a conversation rather than a patch, for anyone who does not operate the platform directly. Ask the provider which RMM product they use, when it was patched relative to 5 September, whether they have hunted for compromise rather than assumed a patch was sufficient — Huntress found a compromise in a fully patched environment — and which of your machines carry their agent. That last list is worth obtaining and reviewing regardless of this advisory: an RMM agent on an OT-side host is a permanent remote code execution path into the process network, and whether it belongs there is a decision that in most plants has never actually been made.