# A CVE in the CISA KEV Catalog (CVE-2026-86218) A 2026 CVE in the CISA KEV catalog with a CVSS 4.0 score of 10.0 and a CVSS v3.1 score of 9.8. Source: https://docs.deepinfo.com/reference/vulnerability/detail/examples/cve-2026-86218/ Last updated: 2026-09-24 --- `GET https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2026-86218` A 2026 CVE in the CISA KEV catalog with a CVSS 4.0 score of 10.0 and a CVSS v3.1 score of 9.8. Example 1 of 3 in **Recent CVEs** · [Vulnerability Detail Examples](/reference/vulnerability/detail/examples/) · endpoint: [Detail](/reference/vulnerability/detail/) Tags: `param` `cve` · `value` `CVE-2026-86218` Asks for `CVE-2026-86218`, a static code injection flaw in N-able N-central. ## What to Notice - `metrics` has a CVSS 4.0 score (10.0, `Secondary`, from a source identified by a UUID) and a CVSS v3.1 score (9.8, `Primary`, from the NVD). `enrichment.vdeep_metric` uses the CVSS 4.0 score, the newest version. - `cisa_exploit_add` and `enrichment.cisa_kev.date_added` are 2026-09-08, two days after publication. ## Request | Parameter | In | Value | |---|---|---| | `cve` | query | `CVE-2026-86218` | ```bash curl 'https://api.deepinfo.com/v1/discovery/vulnerability-detail?cve=CVE-2026-86218' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' ``` ## Response ### 200 · OK > Shortened for this page: enrichment.cpe[].affected_versions: first 10 items; enrichment.cpe[].cpe_names: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "id": "CVE-2026-86218", "source_identifier": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "published": "2026-09-06T03:17:17Z", "last_modified": "2026-09-09T05:18:19Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": "2026-09-08", "cisa_action_due": "2026-09-11", "cisa_required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "cisa_vulnerability_name": "N-able N-central Static Code Injection Vulnerability", "descriptions": [ { "lang": "en", "value": "N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14." } ], "references": [ { "url": "https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution", "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "metrics": { "cvss_metric_v40": [ { "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.8, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-96" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*", "match_criteria_id": "6CEC2750-AFFB-40A4-97E0-88BDAC106F5E", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2026.3" }, { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:2026.3:-:*:*:*:*:*:*", "match_criteria_id": "EB21160B-DDC4-4F70-A703-E313DED8CAF2", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix1:*:*:*:*:*:*", "match_criteria_id": "B28786B6-1DFC-4088-B3CC-C099719EDA17", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix2:*:*:*:*:*:*", "match_criteria_id": "24B69FFD-40FD-4DE2-AC51-A2101AD28EB3", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix3:*:*:*:*:*:*", "match_criteria_id": "BFA703C2-2F80-4FAC-9DA8-EE33A0F0646F", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*", "vendor": "n-able", "product": "n-central", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "2026.3", "affected_versions_first": "2023.4", "affected_versions_last": "2026.2", "affected_versions": [ "-", "2023.4", "2023.6", "2023.7", "2024.1", "2024.2", "2024.3", "2024.4", "2024.6", "2025.1" ], "cpe_names": [ { "cpe_name": "cpe:2.3:a:n-able:n-central:-:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:n-able:n-central:2023.4:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:n-able:n-central:2023.6:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:n-able:n-central:2023.7:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:n-able:n-central:2024.1:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:n-able:n-central:2024.2:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:n-able:n-central:2024.3:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:n-able:n-central:2024.4:*:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:n-able:n-central:2024.6:-:*:*:*:*:*:*", "deprecated": false }, { "cpe_name": "cpe:2.3:a:n-able:n-central:2024.6:hotfix1:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:a:n-able:n-central:2026.3:-:*:*:*:*:*:*", "vendor": "n-able", "product": "n-central", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2026.3", "affected_versions_last": "2026.3", "affected_versions": [ "2026.3" ], "cpe_names": [ { "cpe_name": "cpe:2.3:a:n-able:n-central:2026.3:-:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix1:*:*:*:*:*:*", "vendor": "n-able", "product": "n-central", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2026.3", "affected_versions_last": "2026.3", "affected_versions": [ "2026.3" ], "cpe_names": [ { "cpe_name": "cpe:2.3:a:n-able:n-central:2026.3:hotfix1:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix2:*:*:*:*:*:*", "vendor": "n-able", "product": "n-central", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2026.3", "affected_versions_last": "2026.3", "affected_versions": [ "2026.3" ], "cpe_names": [ { "cpe_name": "cpe:2.3:a:n-able:n-central:2026.3:hotfix2:*:*:*:*:*:*", "deprecated": false } ] }, { "criteria": "cpe:2.3:a:n-able:n-central:2026.3:hotfix3:*:*:*:*:*:*", "vendor": "n-able", "product": "n-central", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2026.3", "affected_versions_last": "2026.3", "affected_versions": [ "2026.3" ], "cpe_names": [ { "cpe_name": "cpe:2.3:a:n-able:n-central:2026.3:hotfix3:*:*:*:*:*:*", "deprecated": false } ] } ], "cwe": [ { "id": 96, "owasptop10_2021": "A03 Injection", "name": "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", "description": "The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.", "capec_id": [ 35, 73, 77, 81, 85 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Non-Repudiation", "Other" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Gain Privileges or Assume Identity", "Hide Activities", "Read Application Data", "Read Files or Directories" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.07494, "percentile": 0.94295, "date": "2026-09-21" }, "cisa_kev": { "vendor_project": "N-able", "product": "N-central", "vulnerability_name": "N-able N-central Static Code Injection Vulnerability", "date_added": "2026-09-08", "short_description": "N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.", "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "due_date": "2026-09-11", "known_ransomware_campaign_use": "Unknown", "notes": "https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/ ; https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-86218" }, "vdeep_metric": { "available_versions": [ "4.0", "3.1" ], "source": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } } } ``` ## Related Examples - [Three CVSS Versions in One Record (CVE-2026-86152)](/reference/vulnerability/detail/examples/cve-2026-86152/) - [A Deferred CVE (CVE-2026-9508)](/reference/vulnerability/detail/examples/cve-2026-9508/) - [OpenSSH regreSSHion (CVE-2024-6387)](/reference/vulnerability/detail/examples/cve-2024-6387/) - [XZ Utils Backdoor (CVE-2024-3094)](/reference/vulnerability/detail/examples/cve-2024-3094/) - [Citrix Bleed (CVE-2023-4966)](/reference/vulnerability/detail/examples/cve-2023-4966/) - [Log4Shell (CVE-2021-44228)](/reference/vulnerability/detail/examples/cve-2021-44228/)