← gociux.comall exploited CVEs

Exploited vulnerability · CISA KEV

Is CVE-2026-86218 exploited? Yes: in CISA KEV since 8 Sep 2026

Gociux · N-able N-central · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2026-86218, N-able N-central Static Code Injection Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 8 Sep 2026, 2 days after it was published. It affects N-able N-central. If you run it, CISA's required action is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

exploitedYesCISA KEV · 8 Sep 2026
ransomwareNot knownno confirmed use
EPSStop 5%very likely to be exploited
severity10CVSS 4.0 · critical
US federal due11 Sep 2026BOD 22-01 deadline

What it is

N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.

VendorN-able (5 exploited CVEs in KEV)
ProductN-central
VulnerabilityN-able N-central Static Code Injection Vulnerability
WeaknessCWE-96
Published6 Sep 2026
Added to KEV8 Sep 2026
Reported by (CNA)N-able

What to do

  1. Check whether you run it. Look for N-central in your asset inventory, including appliances and cloud images. Stack check lists every exploited N-able CVE at once.
  2. Apply the fix. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
  3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 6 Sep 2026.
  4. Get told next time. Email alerts when CISA adds a CVE for N-able.

Other exploited CVEs in N-central

References

Questions

Is CVE-2026-86218 being exploited?

Yes. CISA added CVE-2026-86218 to the Known Exploited Vulnerabilities catalog on 8 Sep 2026, which means there is reliable evidence of exploitation in the wild.

Is CVE-2026-86218 used in ransomware attacks?

CISA does not list known ransomware use for it. That can change, and exploitation alone is reason to fix it first.

How do I fix CVE-2026-86218?

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Check N-able's advisory for the fixed versions, and if you can't patch quickly, restrict access to the affected N-central and watch it for signs of compromise.

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in September 2026 · N-able scorecard · act-now radar.

Running N-able in a regulated environment?

We check exposure across your estate, patch or mitigate with your team, and set up detection for what attackers do after exploiting it.

Get in touch →