If your business relies on a managed service provider rather than an in-house IT team, the tool that provider uses to manage you just failed for the third time since late July.
A pre-auth RCE with a perfect severity score
CVE-2026-86218 is a static code injection flaw (CWE-96) in N-able’s N-central remote monitoring and management platform that lets an attacker execute arbitrary commands on an exposed N-central server without logging in at all. It carries the maximum CVSS score of 10.0. N-able confirmed active exploitation before releasing 2026.3 Hotfix 4, which brings on-premises deployments to build 2026.3.1.14, on September 5. Any server running an earlier build is vulnerable today. Security firm Huntress also flagged two related high-severity issues, CVE-2026-86206 and CVE-2026-86207, which allow authentication bypass and unrestricted platform access.
Why one platform failing three times matters more than one CVE
This is not an isolated bug report. It is the third independently disclosed zero-day against N-central in six weeks, following CVE-2026-18577 in early August. N-central is not a peripheral tool for the organisations that run it, it is the platform that lets a managed service provider see into, configure and remotely control every client endpoint it manages. A pre-auth RCE against that platform does not just expose the MSP, it potentially exposes every business downstream of it in one step, which is exactly the kind of concentrated blast radius that regulators and insurers are increasingly asking businesses to account for.
What this means if you outsource your IT
Most businesses that use a managed service provider have no visibility into which RMM platform that provider runs or how quickly it gets patched. That is a reasonable division of labour right up until a platform like this has its third zero-day in six weeks. If you are a European business relying on outsourced IT support, it is a fair question to ask your provider directly: are you running N-central, and if so, are you already on 2026.3.1.14 or later.
If you want an independent check on whether your outsourced IT setup, or your own on-premises RMM deployment, is exposed to this kind of cascading risk, contact Excello Digital. We help European businesses understand and reduce the security dependencies hiding inside their outsourced infrastructure.