Managed service providers have patched the same product three times in a week. N-able's N-central, the console MSPs use to monitor and administer thousands of customer networks from a single dashboard, is being attacked through a flaw that had no fix when the first intrusion was found. On September 8 CISA added it to the federal Known Exploited Vulnerabilities catalog.
The bug, CVE-2026-86218, is a pre-authentication code injection flaw carrying a CVSS score of 10.0, the highest the scale allows. Pre-authentication means an attacker needs no password and no account on the server to use it.
Huntress, whose researchers spent the week on it, documented the sequence. Its investigation opened on September 4, after a customer's fully patched N-central production environment was compromised. By September 5 the team had reproduced a working proof of concept against N-central 2026.3.1.10 and taken it to N-able, which shipped hotfix 2026.3.1.13. A day later a third, unrelated vulnerability surfaced from an independent researcher, and N-able released 2026.3 Hotfix 4 to supersede that build.
N-able's own account of the exploitation is not consistent. In an MSPGeek Discord thread, N-able's Jason Murphy wrote that a third researcher had alerted the company to a vulnerability "that has been exploited in the wild", and later said plainly, "this one is a Zero day." The HF4 release notes take a softer line, saying the company has no confirmations that the flaw has been exploited in production environments while warning that unpatched systems remain at risk. Huntress cannot settle the question either: logs on the compromised server had already rotated, so the firm says it cannot determine which vulnerability the intruder actually used.
A semicolon that fools two servers
The two earlier flaws, found by Stephen Fewer at Rapid7, are worth understanding because they show how thin the wall around the management interface is. N-central puts an Envoy proxy in front of Jetty, the Java server that hosts the application, and Envoy returns a 403 for any path beginning with /dms/services. As Rapid7 sets out in its write-up, a request for /dms;/services/ServerUI does not match that prefix, so Envoy waves it through to a catch-all route. Jetty then treats the segment starting with the semicolon as a path parameter and removes it, landing the request on the protected SOAP interface after all. A second trick, a Forwarded header claiming the request came from the loopback address with a backslash slipped in before the final digit, makes the application's own filter read a remote client as a local one. Chained, CVE-2026-86206 and CVE-2026-86207 let a remote unauthenticated attacker create a new system administrator account. Rapid7 scores them 6.9 and 7.7 on CVSSv4, and both were fixed in Hotfix 3.
Upgrade to 2026.3 HF4, then go hunting
On-premises operators should move to 2026.3 HF4 now, including anyone who applied HF3 earlier in the week. N-able says hosted instances are already patched. Because the exploited flaw hands over control of user management, patching by itself is not enough. Huntress points defenders at three files on the appliance, envoy_proxy_HTTPS.log, syslog and ncentraldms, and says to look for successful requests to internal API routes containing URL-encoded values such as %2F. Audit recently created accounts as well. The intruders appended strings such as .invalid to genuine N-able email addresses, and used character swaps and lookalike domains that survive a quick glance. Staging activity showed up as probes of the /remoteControlAction.do?method=getPierDetails endpoint. Huntress also went to Cloudflare directly to disable the tunnels the attackers were relying on as backdoors.
Indicators
Huntress published infrastructure tied to the activity, including 23[.]234[.]100[.]105, 185[.]156[.]46[.]150, 92[.]118[.]112[.]181 and 37[.]19[.]210[.]32, alongside the file hash 5568cd69c754b392121f1dbb8f900fda.
This is the second time this summer that N-central has been the way in rather than the thing being defended. CISA warned about an N-able login bypass in August, and intruders who got in that way stacked six remote access tools on the servers they reached. A console built to reach every endpoint a provider manages is worth more to an attacker than any single customer sitting behind it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.