pre-authentication remote code execution

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

1. 2026-09-05 First public exploit (Metasploit exploit/linux/http/nable_ncentral_unauth_rce_cve_2026_86218)
2. 2026-09-06 Published
3. 2026-09-07 CISA SSVC: exploitation active
4. 2026-09-08 Added to CISA KEV
5. 2026-09-11 CISA patch deadline

Added

2 mo ago (2026-09-08)

Patch by

2026-09-11 (59 d ago)

Ransomware

Not known

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor, product

N-able, N-central

CISA name

N-able N-central Static Code Injection Vulnerability

Exploitation

Active, exploited in the wild

Automatable

yes

Technical impact

total

Assessed

2 mo ago (2026-09-07)

15.38% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Metasploit exploit/linux/http/nable_ncentral_unauth_rce_cve_2026_86218 N-able N-central Struts BeanUtils Unauthenticated RCE metasploit exploit, great rank, 2026-09-05
• Nuclei template N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution nuclei detection template

• N-able N-central

Weakness

• CWE-96 Improper Neutralization of Directives in Statically Saved Code

• me.n-able.com /s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution

  vendor-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218

  government-resource, us-government-resource

• CVE List CVE-2026-86218
• NVD CVE-2026-86218

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.