CVE-2026-86218

N-able N-central has a pre-authentication remote code execution vulnerability actively exploited in the wild.

N-able N-central contains a static code injection flaw allowing pre-authentication remote code execution, currently listed in CISA's KEV catalog. This is a severe, avoidable failure because it enables attackers to execute arbitrary code without needing to authenticate, directly impacting DIB organizations using the product for security operations. Organizations must immediately patch or replace this software to prevent compromise.

Shame score — A pre-authentication RCE flaw actively exploited in the wild demonstrates severe negligence and a failure to patch a critical vulnerability before it was weaponized.