Pre-authentication remote code execution in N-able N-central

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

• Vendor: N-able.
• Product: N-central.
• Default status: unaffected outside the affected version scope.
• Affected versions: versions before 2026.3.1.14.
• 2026.3.1.14 is the version boundary supplied by the structured affected data. The status of parallel branches or later versions has not been independently confirmed in this record.

N-able N-central contains a static code injection flaw classified as CWE-96 that can lead to pre-authentication remote code execution. The flaw is reachable over the network; the supplied record states that no account or user interaction is required and that attack complexity is low. The record does not identify the endpoint, request field, stored object, or specific component that supplies the injected directive, so the internal processing path and payload cannot be described reliably. The privilege level of the executing process is also not disclosed. The affected scope is limited to N-central versions before 2026.3.1.14 according to the supplied structured product data.

The flaw is remotely reachable over the network before authentication and requires neither prior access nor user interaction. The supplied record marks the vulnerability as known exploited and as having a public exploit. Additional CISA data reflected in the research results states that exploitation is active and automatable. The available evidence does not provide an exploit name, exploitation sequence, payload, or specific indicator of compromise.

The flaw enables pre-authentication remote code execution on an affected system, with potential consequences for system confidentiality, integrity, and availability. An attacker does not need prior privileges or user interaction, so a network-reachable server can be targeted directly. The specific privilege level of executed code is not stated, so the operating-system privilege or post-exploitation control cannot be confirmed. The scoring data indicates that impact may extend to related scope, but it does not identify specific downstream assets. Organizations may need to isolate the management system, investigate compromise, and restore trust in the server and its administrative functions.

Successful exploitation could let an attacker execute code on an N-central system without an account or user action. Possible consequences include unauthorized access to data handled by the server, changes to configuration or data, and disruption of management services. Because N-central is a management product, a compromised server could become a starting point for assessing related assets, but the available evidence does not identify which downstream assets would be reachable. Organizations should treat exposed instances as potentially compromised until review is complete.

1. Upgrade N-able N-central to 2026.3.1.14, the fixed-version boundary supplied by the affected-product data.
2. Verify the result on every node or appliance, not only on the central management server. Do not infer from this fix that every parallel branch or later version has been independently confirmed unaffected.
3. Until the update can be applied, reduce network exposure through appropriate access controls and by limiting which sources can reach the N-central interface. This is a temporary compensating measure, not a replacement for the update.
4. Because the record marks the issue as publicly exploitable and exploited, assess the possibility of compromise rather than only applying the update. Preserve relevant logs and evidence, and activate incident response if suspicious activity is found.
5. After remediation, recheck the N-central inventory and confirm that no instance remains on a version before 2026.3.1.14.

1. Inventory every server and appliance running N-central, including systems that manage other assets or expose an administrative interface to untrusted networks.
2. Check the exact version on each system and treat every version before 2026.3.1.14 as affected according to the record's version scope.
3. Identify systems reachable from the Internet or other untrusted networks, because the flaw can be exploited over the network before authentication.
4. Because the record marks the vulnerability as exploited, review authentication events, unusual requests, and unexpected process activity for an appropriate period. This is precautionary monitoring, not a confirmed vulnerability-specific IOC set.
5. Preserve relevant forensic data before changing or rebuilding a system. The absence of suspicious log entries does not prove that a system is safe.