N-able N-Central: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen
WID-SEC-2026-3205 · first 07.09.2026 · updated 09.09.2026 · CVSS 10,0
What it is about
N-able N-central ist eine Remote Monitoring and Management (RMM)-Plattform für Managed Service Provider (MSPs) und IT-Abteilungen Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in N-able N-Central ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder Code auszuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- Informationen offenzulegen
- Sicherheitsmaßnahmen zu umgehen oder Code auszuführen
Am I affected?
Affected according to the BSI:
- N-able N-Central <2026.3 Hotfix 3
- N-able N-Central <2026.3 Hotfix 4
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- N-able N-Central 2026.3 Hotfix 3
- N-able N-Central 2026.3 Hotfix 4
Is the vulnerability already being exploited?
- CVE-2026-86218: exploited in the wild according to CISA, in the catalogue since 08.09.2026.
Information and sources
- Original BSI advisory (WID)
- N-able Release Notes vom 2026-09-06 status.n-able.com
- N-able Release Notes vom 2026-09-06 status.n-able.com
- Bleeping Computer vom 2026-09-06 www.bleepingcomputer.com
- CISA Known Exploited Vulnerabilities Catalog vom 2026-09-08 www.cisa.gov
- Huntress Blog vom 2026-09-08 www.huntress.com
CVE: CVE-2026-86206, CVE-2026-86207, CVE-2026-86218
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.