Threat Brief — 2026-09-09 — N-able RCE confirmed exploited

CISA has confirmed active in-the-wild exploitation of a maximum-severity pre-authentication remote code execution flaw in N-able N-central, tracked as CVE-2026-86218KEV and listed in the KEV catalog. This is the most actionable item today. No other fresh findings were ingested in the last four hours.

Top items

• N-able N-central pre-auth RCE (CVE-2026-86218KEV) — actively exploited. A maximum-severity pre-authentication remote code execution vulnerability in N-able N-central has been added to CISA's Known Exploited Vulnerabilities catalog, confirming real-world exploitation. Federal agencies are required to remediate per BOD 22-01 deadlines; any organisation running N-central should treat this as urgent given the pre-auth nature and confirmed exploitation. This continues a story first reported 2026-08-17 covering multiple CVEs added to CISA KEV across Windows, N-able, and Adobe Commerce (src: The Hacker News). First reported on that story: (src: CISA Current Activity).

Themes

The N-able N-central flaw underscores a persistent pattern this briefing period: pre-authentication RCE vulnerabilities in management and RMM platforms are being actively exploited before or shortly after vendor disclosure, and CISA KEV listings continue to serve as the most reliable signal that exploitation has moved from theoretical to operational.