#msp

2 articles

N-able's two documents disagreed about exploitation. CISA has settled it

2026-09-07Security

CVE-2026-86218 is a CVSS 10.0 pre-authentication RCE in N-central, patched in the fourth hotfix in five weeks. For two days the vendor's release notes and its incident notice said opposite things about whether it was being exploited. CISA added it to the KEV catalogue on 8 September with a three-day federal deadline.

N-able patched an auth bypass in N-central. The patch was incomplete, and attackers came back through the same door

2026-08-09Security

CVE-2026-18577 exists because the fix for CVE-2026-18556 didn't finish the job. Both are being exploited, and N-central sits at the top of MSP estates — admin on the server means Take Control access to every endpoint underneath it.