TLDR Tech / InfoSec
N-able patches max-severity N-central flaw amid ongoing attacks
Unauthenticated attackers can execute code on internet-exposed N-central RMM servers through a low-complexity attack exploiting CVE-2026-86218. Huntress has flagged it as a potential zero-day after finding a compromised customer instance whose logs had already rotated. Shadowserver counts nearly 1,500 exposed N-central servers, most in the United States and Europe. On-premises operators need N-central 2026.3 Hotfix 4 immediately, since HF3 systems remain vulnerable to this flaw despite last week's fixes for the authentication-bypass pair CVE-2026-86206 and CVE-2026-86207.
Read the full story