N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed. N-able has released its fourth hotfix in five weeks for the...

PT-2026-86675

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

CVE-2026-77699: Improper Privilege Management

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

CVE-2026-85640: Improper Privilege Management

Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component...

CVE-2026-77698: Improper Privilege Management

Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade...

CVE-2026-77697: Improper Privilege Management

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction...

PT-2026-86674

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction...

PT-2026-86677

Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component...

PT-2026-86664

Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade...

CVE-2026-86218

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14...

CVE-2026-86218

N-central (N-able) is affected by a pre-authentication remote code execution vulnerability in versions prior to 2026.3.1.14 . The CVSS 4.0 base score is 10.0 (CRITICAL) , with high impact across confidentiality, integrity, and availability for both vulnerable and subsequent systems. CISA's SSVC a...

EUVD-2026-72041

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14...

CVE-2026-86218 pre-authentication remote code execution

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14...

CVE-2026-86218 pre-authentication remote code execution

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14...

PT-2026-86470

Name of the Vulnerable Software and Affected Versions N-central versions prior to 2026.3.1.14 Description N-central contains a static code injection flaw that allows for pre-authentication remote code execution. This issue has been exploited in the wild and is particularly critical as the platfor...

CVE-2026-86218: Improper Neutralization of Directives in Statically Saved Code

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14...

VulnCheck KEV: CVE-2026-86218

N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution...

CVE-2026-86206

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...

EUVD-2026-72023

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...

CVE-2026-86206 Access control filter bypass allows unauthorised access to APIs

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4...