[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":57,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":64,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":70,"vulnerability-29941":77},[4,13,23,35,43,50],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":8,"variant":12,"priority":12,"campaign_id":6},"PHP2Shell, Node2Shell, *sshole detections - pricing page","node2shell-exploit","Detect PHP2Shell, Node2Shell & *sshole with every paid plan.",null,false,[11],"\u002Fpricing","secondary",{"title":14,"slug":15,"text":16,"link":17,"external":18,"targets":19,"cta":22,"variant":12,"priority":12,"campaign_id":15},"Office Hours #15","office-hours-15","[Live Office Hours, Wed Nov 18] Behind the login, beyond the scan","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_BUp1qET2THa_5h65whpx9g",true,[20,21],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot",{"title":24,"slug":25,"text":26,"link":27,"external":9,"targets":28,"cta":34,"variant":12,"priority":12,"campaign_id":25},"*sshole, PHP2Shell & Node2Shell - HP, Vuln DB, product page","sshole-detect-exploit","🚨 Detect *sshole & Node2Shell with any paid plan. Get proof with our Sniper exploit","https:\u002F\u002Fpentest-tools.com\u002Fpricing",[29,30,31,32,33],"\u002F","\u002Fvulnerabilities-exploits","\u002Fvulnerabilities-exploits\u002Fopenssh-musl-authentication-bypass-cve-2026-123158-sshole_29981","\u002Fvulnerabilities-exploits\u002Fnode2shell-http2shell-brotli-decoder-remote-code-execution_29896","\u002Fproduct","See pricing options",{"title":36,"slug":37,"text":38,"link":27,"external":9,"targets":39,"cta":41,"variant":12,"priority":12,"campaign_id":42},"*sshole - Exploit on Sniper: Auto-Exploiter page","sshole-exploit-sniper","🚨 Exclusive exploit for *sshole now live",[40],"\u002Fexploit-helpers\u002Fsniper","Use it with the Exploit plan","sshole-exploit",{"title":44,"slug":45,"text":46,"link":27,"external":18,"targets":47,"cta":49,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - Exploit on the NS page","sshole-exploit-ns","🚨 Go beyond *sshole detection: get proof of exploitation",[48],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick the Exploit plan",{"title":51,"slug":52,"text":53,"link":27,"external":18,"targets":54,"cta":34,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - WS, free tools","sshole-exploit-mainpw","Detect *sshole with every paid plan. Prove it with Exploit.",[55,56],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffor\u002Ffree",["Island",58],{"key":59,"params":60,"result":62},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":61},"{}",{"head":63},{},["Island",65],{"key":66,"params":67,"result":68},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":61},{"head":69},{},["Island",71],{"key":72,"params":73,"result":75},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":74},"{\"text-color\":\"gray\"}",{"head":76},{},{"id":78,"detectable_with":79,"vuln_details":85,"vuln_id":107,"name":108,"published":109,"updated":109},29941,{"tool":80,"engine":83},{"id":81,"name":82},1,"Network Scanner",{"id":81,"name":84},"Sniper",{"id":78,"codename":8,"description":86,"severity":87,"risk_description":88,"public_description":89,"public_recommendation":90,"recommendation":91,"references":92,"cvssv3":96,"epss_score":97,"epss_percentile":98,"cve":99,"in_cisa_catalog":18,"date":101,"software_type":102,"vendor":103,"product":104,"ptt_exploit_capabilities":105},"We found that the target server is vulnerable to CVE-2026-86218, an unauthenticated remote code execution affecting N-able N-central versions prior to 2026.3.1.14. The flaw is a static code injection (CWE-96): a session-scoped Struts form on the unauthenticated remoteControlAction.do endpoint can be raced with two concurrent multipart requests so that Apache Commons BeanUtils populates attacker-controlled property paths over Jetty's live object graph, replacing a lazy N-central servlet holder with Jetty's bundled CGI servlet configured with commandPrefix \u002Fbin\u002Fsh -s. A follow-up request to that servlet then executes arbitrary shell commands as the N-central service user. We confirmed the vulnerability by reading the version the appliance advertises on the unauthenticated remote-control endpoint.","critical","This vulnerability permits full compromise of the N-central server without credentials, allowing attackers to steal credentials, deploy ransomware or backdoors across all managed endpoints, and pivot into customer networks; the impact and scope are critical and exploitation has been observed in the wild.","N-able N-central versions prior to 2026.3.1.14 contain a pre-authentication remote code execution vulnerability stemming from static code injection (CWE-96) in the management interface. An unauthenticated remote attacker with network access to the N-central management interface can inject code that the server executes, enabling arbitrary command execution on the appliance. Successful exploitation can directly compromise the N-central service account and the managed estate.","Upgrade N-able N-central to version 2026.3.1.14 (Hotfix 4) or later immediately.","We recommend upgrading on-premises N-able N-central installations to version 2026.3.1.14 (2026.3 Hotfix 4) or later immediately. As an additional mitigation, restrict inbound access to the N-central management interface via IP allowlisting and audit for unauthorized accounts and a mutated\u002FCGI remote-control servlet.",[93,94,95],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-86218","https:\u002F\u002Fme.n-able.com\u002Fs\u002Fsecurity-advisory\u002FaArVy0000002Ld3KAE\u002Fcve202686218-preauthentication-remote-code-execution","https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Fn-able-vulnerability-exploitation",10,0.15385,0.9681,[100],"CVE-2026-86218","2026-09-06T00:00:00Z","Remote Monitoring and Management","N-able","N-central",[106],"RCE","NETSCAN-SNIPER-CVE-2026-86218","N-able N-central - Pre-Authentication Remote Code Execution","2026-10-13T00:00:00Z"]