N-able Told Its Customers It Was a Zero-Day. Its Own Release Notes Said No One Had Seen It Exploited.

On September 4, a managed service provider's N-central server — fully patched, per the customer — was compromised. Over the next four days, N-able shipped its fourth hotfix in five weeks, disclosed three more vulnerabilities, and told its customers privately that one of them was an actively exploited zero-day. Its own public release notes said the opposite. The incident responders who broke the story admit they can't say which of three bugs actually let the attacker in, and that their own headline claim rests entirely on the vendor's word.

The fourth hotfix in five weeks

N-central is the on-premises console MSPs use to monitor and remote-control every endpoint across every client network they manage from one screen. That concentration is exactly why its vulnerability history this year keeps making news — CVE-2026-18556 and CVE-2026-18577, covered here in August, were already a KEV-listed pair (the second one was N-able's own incomplete fix for the first). CVE-2026-86218 is the third N-central CVE in our own database now marked in CISA's Known Exploited Vulnerabilities catalog, and it arrived alongside two siblings that shipped in the same hotfix cycle.

One compromise, three suspects

The awkward part of this timeline is the middle: the Sept 4 compromise happened before Hotfix 3 and Hotfix 4 existed, which means the attacker used one of the bugs those two hotfixes later fixed — CVE-2026-86206, CVE-2026-86207, or CVE-2026-86218. Huntress, the security firm that investigated, could not narrow it down.

The reason is mundane and familiar to anyone who has run an incident response: by the time investigators got access, the appliance's own logs had already rotated. Huntress did reproduce a proof-of-concept exploit chain against the build the victim was running, but couldn't tie the live intrusion to a specific CVE with the evidence that remained.

The vendor said two different things

Huntress flagged the contradiction directly rather than resolving it in the vendor's favor — and then added an important caveat about its own reporting.

Independent reproduction did happen, though: researchers at watchTowr said they successfully reproduced the exploit chain and confirmed it lets an attacker make changes that propagate across every system N-central manages — which, for an MSP console, means every downstream client network. Whether or not it was the specific bug used on Sept 4, CVE-2026-86218 is real, reachable pre-authentication, and now three days into a CISA-mandated federal patch window that closes today.

What Huntress is telling customers to check

1. Patch to Hotfix 4 (build 2026.3.1.14) — Hotfix 3 alone does not close CVE-2026-86218.
2. Audit N-central user accounts for anomalies, specifically emails with a ".invalid" suffix appended to a legitimate address — the pattern Huntress observed attackers using when creating accounts.
3. Review envoy_proxy_HTTPS.log and the ncentraldms syslog for API manipulation, including URL-encoded anomalies such as %2F.
4. Restrict inbound network access to the N-central console — IP allowlisting or a mandatory VPN — since this is a pre-authentication flaw reachable from anywhere it's exposed.
5. If you run Huntress Managed EDR, confirm Managed Response isolation and active remediation settings are enabled on the appliance host.

Reported facts current as of 2026-09-11live record →