Topic

Remote Monitoring and Management

Category of software letting IT teams and managed service providers remotely control and manage endpoints at scale; a frequent target for attackers.

Current stories

securityConfirmed7 publishers

CVE-2026-86218 gives unauthenticated attackers code execution on N-able N-central consoles

N-able shipped N-central 2026.3 HF4 on Saturday and says nothing confirms production exploitation, while Huntress calls the bug a possible zero-day and has one compromised customer console whose logs had already rotated.

Publishers:bleepingcomputer.com helpnetsecurity.com infosecurity-magazine.com n-able.com scworld.com securityweek.com thehackernews.com

Perspective Coverage

7 publishers

Builder: Builder 17%
Operator: Operator 75%
Investor: Investor 8%

Reality

Evidence72
Adoption40
Hype gap+10
Incentives55
Confidence70

securityConfirmed2 publishers

CISA put N-able's pre-auth N-central RCE on KEV three days after the hotfix shipped

CVE-2026-86218 lets an unauthenticated attacker run code on an N-central server with no user interaction. N-able fixed it in build 2026.3.1.14 and has already patched its own hosted instances.

Publishers:horizon3.ai n-able.com

Reality

Evidence68
Adoption: Not scored
Hype gap+5
Incentives70
Confidence70

securityOne report1 publisher

Storm-2570 brings the same intrusion toolkit to Qilin, DragonForce, Anubis and BERT attacks

Microsoft says affiliate Storm-2570 has run the same remote access and exfiltration tools whether it deploys Qilin, DragonForce, Anubis or BERT ransomware. Detections built on those tools can catch the operator before any payload runs.

Publishers:microsoft.com

Reality

Evidence55
Adoption: Not scored
Hype gap+10
Incentives30
Confidence55

securityOne report1 publisher

Attackers are phishing employees into installing rogue ITarian and ScreenConnect clients

Huntress says three of its SOC investigations began with document lures and ended with victims installing rogue ITarian and ScreenConnect clients, and its responders now find RMM abuse in almost 40% of the incidents they work.

Publishers:huntress.com

Reality

Evidence45
Adoption50
Hype gap+20
Incentives78
Confidence48

buildOne report1 publisher

N-able's fourth hotfix is the one that closes the N-central code injection

CVE-2026-86218 turns an unauthenticated request to an N-central server into code execution on the platform that pushes scripts to a provider's whole customer estate. A CVSS 10.0 only scores the server.

Publishers:dev.to

Reality

Evidence46
Adoption44
Hype gap+14
Incentives38
Confidence54