A public Metasploit module now exploits CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-able N-central on CISA KEV since September. Patch to 2026.3.1.14.
Rapid7 has shipped a Metasploit exploit module for CVE-2026-86218, an unauthenticated remote code execution flaw in N-able N-central, the remote monitoring and management (RMM) platform that managed service providers use to run their customers' endpoints. Any self-hosted N-central server below build 2026.3.1.14 that is reachable from the network is now exposed to a public, packaged exploit. Because one N-central server manages many customer networks, a compromised console can become a way into all of them.
What happened
N-able published the fix, 2026.3 Hotfix 4 (build 2026.3.1.14), on 6 September 2026. The NVD record lists the flaw as a pre-authentication RCE, weakness CWE-96 (static code injection). The CNA score is CVSS v4.0 10.0; NVD's own v3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N). CISA added it to the Known Exploited Vulnerabilities catalog on 8 September with an 11 September deadline for federal agencies. Its entry lists ransomware use as "Unknown", and NVD records CISA's SSVC assessment as active exploitation, automatable, total technical impact.
On 9 October, Rapid7's Metasploit wrap-up announced the module linux/http/nable_ncentral_unauth_rce_cve_2026_86218 ("N-able N-central Struts BeanUtils Unauthenticated RCE"), written by Stephen Fewer (sfewer-r7) and merged through pull request #21896. Rapid7 describes it as targeting N-central 2026.3.1.13 and below.
From the August unpatched count to a public exploit module.
Is it being exploited?
The sources disagree on wording. N-able's advisory says it has "no confirmations that this vulnerability has been exploited in production environments". Coverage by The Hacker News quotes an urgent N-able customer notice saying the flaw "has been observed being exploited in the wild". CISA's KEV listing is itself a claim of exploitation.
Huntress investigated a compromise of a fully patched N-central customer environment starting 4 September, before this CVE was public. Its logs had rotated, so it could not say whether CVE-2026-86218 or the separate authentication bypass pair CVE-2026-86206 and CVE-2026-86207 (fixed in Hotfix 3 on 5 September) was used. Earlier, in August, Huntress had seen N-central exploitation across multiple organisations, with attackers using the built-in Take Control feature and Cloudflare tunnels and going after domain controllers. Treat the September intrusion as not attributed to this CVE.
Who is affected
Self-hosted N-central servers below 2026.3.1.14. N-able says hosted (NCOD) instances are already patched. Supported direct upgrade paths to the fixed build are 2025.4, 2026.1, 2026.2, 2026.3 and 2026.3.1 HF1 and HF2; older versions must first move to one of those. Agents do not need upgrading for this CVE.
Patching has lagged before: on 3 August, Huntress measured 13.6% of reachable N-central servers unpatched, 28.6% of the self-hosted ones. A secondary Cloud Security Alliance note, citing Shadowserver, puts internet-facing N-central servers at about 1,500.
What defenders should do
- Upgrade self-hosted servers to 2026.3.1.14 now, even if Hotfixes 1 to 3 are installed.
- Take the console off the open internet: allowlist addresses or require a VPN, and enforce MFA on admin accounts. Huntress suggests considering a temporary shutdown if it cannot be restricted.
- Assume possible earlier compromise. Review
envoy_proxy_HTTPS.logand thencentraldmssyslog for URL-encoded (%2F) API requests, and audit admin accounts for new or promoted users, including odd names such as.invalidaddresses. - Check Take Control and remote-control sessions, particularly to domain controllers, and look for unexpected
Cloudflaredservices. - Huntress published network and host indicators in its write-up; match them against your logs.