N-central's Pre-Auth RCE Zero-Day: The Vendor Says 'No Confirmations' — and Publishes the Scanners' IP Range

The short version//

N-central, the RMM appliance MSPs use to monitor, patch, and remote into everything they manage, just got a pre-authentication RCE zero-day: CVE-2026-86218, which Huntress rates at CVSS 10.0. The fix is 2026.3 Hotfix 4 (build 2026.3.1.14), shipped September 5–6, and it supersedes HF3. CISA added the CVE to the KEV catalog on September 8 with a federal due date of 2026-09-11, and the "forensic triage" flag, which is CISA's way of saying assume you were in there.

This isn't even N-central's first zero-day this year. It's wave three: two CVEs and hotfixes in August (CVE-2026-18556, then the "incomplete patch" follow-up CVE-2026-18577), a second pair on September 5 (CVE-2026-86206 / CVE-2026-86207, fixed in HF3), and now this one.

The contradiction that is the whole story//

N-able's hotfix page says, verbatim:

"At this time, we have no confirmations that this vulnerability has been exploited in production environments, but unpatched systems remain at risk."

Meanwhile N-able's own security blog describes the same CVE as "a new vulnerability — one that has been exploited in the wild and is unrelated to the previously disclosed CVEs," and an N-able engineer told MSPGeek, per Huntress's reporting, "this one is a Zero day."

And then there's the kicker. In its "How to Check for Indicators of Compromise" section, N-able publishes an IP range it says is scanning for exactly this bug — 23.234.64.0/18 — and tells admins to check their logs for connections from that block:

"We've observed scans originating from the IP range 23.234.64.0/18 attempting to exploit this vulnerability."

Vendors don't usually publish attacker scanner ranges unless they've watched the scanners work. So: "no confirmations" + a published scan range + KEV membership with forensic triage. Read all three together, that's a patch tonight story.

What Huntress actually saw//

Huntress detailed the exploitation observed against N-central starting September 4:

• Attacks targeted the N-central API and appliance logs, not the Take Control abuse pattern from August.
• Attackers created user accounts with mangled names — appending strings like .invalid to known N-able email addresses, or subtle character swaps and spoofed domains designed to pass casual inspection.
• Recon probes hit /remoteControlAction.do?method=getPierDetails with specific appliance IDs before exploitation.
• Persistence ran through Cloudflare tunnels; Huntress worked directly with Cloudflare to disable the adversary's tunnel accounts so existing backdoors die across all affected environments at once.

One caveat that matters: because logging on the appliance is too limited, Huntress explicitly says it cannot confirm which specific exploit was used in the compromised environment — nor rule out alternative vulnerabilities. So "exploited" here means observed activity consistent with exploitation, not a confirmed CVE-to-incident mapping. Their published IoCs for the ongoing N-central campaign include Tzulo VPN exit nodes (23.234.100[.]105, 23.234.97[.]68) and a malicious Cloudflare tunnel account tag.

Why an RMM appliance is the worst shape for this bug//

An admin portal with a crown — but the crown is bigger than usual. N-central isn't managing one box; it's the management plane for every endpoint an MSP runs. Get pre-auth code execution on the appliance and you can run scripts, push tools, and open remote sessions across thousands of downstream machines without touching any of them. CISA classifies this as a static code injection (CWE-96) that grants total control post-exploitation — the same shape as our UniFi SAB-067 and SonicWall SMA1000 stories: the management box is where zero-days live, because everything downstream already trusts it.

What to do//

1. Apply 2026.3 HF4 (build 2026.3.1.14) now if you're on-prem. Per N-able's upgrade paths you can go directly from 2025.4, 2026.1, 2026.2, 2026.3, or any earlier hotfix. Hosted (NCOD) customers: already patched server-side, nothing to do — and no agent upgrade is required either way.
2. Audit user accounts in the console for unknown entries — especially .invalid email addresses and lookalike domains with character swaps. This exploit chain grants full control of user management.
3. Check logs for connections from 23.234.64.0/18, N-able's published scan range, plus the Tzulo VPN exit nodes in Huntress's IoC list.
4. Restrict inbound access to the console — VPN or IP allowlist at minimum. If you're internet-exposed and can't patch tonight, consider taking the server offline temporarily until it's behind strict controls; N-able itself floated that option during the August wave.
5. Take KEV seriously: due date 2026-09-11, forensic triage = yes. If you were exposed before HF4, assume compromise and hunt for lateral movement into managed endpoints — not just on the appliance.