https://vulnerability.circl.lu/sightings/feed 2026-09-14T12:23:18.529889+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/26110b3b-497a-44b2-9062-a6fc7d0d4314/export 2026-09-14T12:23:18.555361+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "26110b3b-497a-44b2-9062-a6fc7d0d4314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86218", "type": "seen", "source": "Telegram/iBj7RYtihqm6hIuCBk6vB4PmaU6fP95etshgJ7uPz9bghck", "content": "", "creation_timestamp": "2026-09-14T03:00:09.092295Z"} 2026-09-14T03:00:09.092295+00:00 https://vulnerability.circl.lu/sighting/20cf0f99-474f-4342-8cf5-06ecfe8aaef9/export 2026-09-14T12:23:18.557776+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "20cf0f99-474f-4342-8cf5-06ecfe8aaef9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86218", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mvh35i7zft25", "content": "CVE-2026-86218, a CVSS 10 N-central vulnerability, is exploited in the wild for remote code execution. A public Metasploit PoC is out. Patch now.\n\n#Nable #Ncentral #CVE202686218 #Cybersecurity #InfoSec", "creation_timestamp": "2026-09-14T02:34:45.585767Z"} 2026-09-14T02:34:45.585767+00:00 https://vulnerability.circl.lu/sighting/ce9ea841-f03d-461c-8fa6-77bfca296c7d/export 2026-09-14T12:23:18.557908+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ce9ea841-f03d-461c-8fa6-77bfca296c7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86218", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102123", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-86218-N-central-IOC-Toolkit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jithinkrishnanrs\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-12 11:04:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDefensive IOC and detection toolkit for CVE-2026-86218, a critical pre-auth RCE in N-able N-central. Includes IOCs, log scanner, Sigma, Splunk, Elastic/KQL detections, and incident response guidance.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-13T00:00:54.027821Z"} 2026-09-13T00:00:54.027821+00:00 https://vulnerability.circl.lu/sighting/1cc3cafc-e0e3-49fa-91fd-9b5f627ddd80/export 2026-09-14T12:23:18.558023+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "1cc3cafc-e0e3-49fa-91fd-9b5f627ddd80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86218", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mvdrhvyojk2h", "content": "Still 218 instances of N-able N-central seen unpatched to CVE-2026-86218 pre-auth RCE that is exploited in the wild & on US CISA KEV. Top: US (141)\n\nStats - World Map view: dashboard.shadowserver.org/statistics/c...\n\nTracker: dashboard.shadowserver.org/statistics/c...", "creation_timestamp": "2026-09-12T19:03:41.496436Z"} 2026-09-12T19:03:41.496436+00:00 https://vulnerability.circl.lu/sighting/547cd274-a7e7-45cc-a1cc-6de047c8652b/export 2026-09-14T12:23:18.558125+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "547cd274-a7e7-45cc-a1cc-6de047c8652b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86218", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mvdrhvynkc2h", "content": "Still 218 instances of N-able N-central seen unpatched to CVE-2026-86218 pre-auth RCE that is exploited in the wild & on US CISA KEV. Top: US (141)\n\nStats - World Map view: dashboard.shadowserver.org/statistics/c...\n\nTracker: dashboard.shadowserver.org/statistics/c...", "creation_timestamp": "2026-09-12T19:03:40.545536Z"} 2026-09-12T19:03:40.545536+00:00 https://vulnerability.circl.lu/sighting/090acb43-c051-4531-989a-c210d051ba46/export 2026-09-14T12:23:18.558229+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "090acb43-c051-4531-989a-c210d051ba46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86218", "type": "seen", "source": "https://bsky.app/profile/shadowserver.bsky.social/post/3mvdrhsggbk2h", "content": "Still 218 instances of N-able N-central seen unpatched to CVE-2026-86218 pre-auth RCE that is exploited in the wild & on US CISA KEV. Top: US (141)\n\nStats - World Map view: dashboard.shadowserver.org/statistics/c...\n\nTracker: dashboard.shadowserver.org/statistics/c...", "creation_timestamp": "2026-09-12T19:03:39.640062Z"} 2026-09-12T19:03:39.640062+00:00 https://vulnerability.circl.lu/sighting/c2292685-1afc-4917-88f9-95fad7108dad/export 2026-09-14T12:23:18.558329+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "c2292685-1afc-4917-88f9-95fad7108dad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86218", "type": "seen", "source": "https://infosec.exchange/users/shadowserver/statuses/117259614409471183", "content": "Still 218 instances of N-able N-central seen unpatched to CVE-2026-86218 pre-auth RCE that is exploited in the wild & on @cisacyber KEV. Top: US (141)\nStats - World Map view: https://dashboard.shadowserver.org/statistics/combined/map/?date_range=1&map_type=std&source=exchange&source=exchange6&source=http_vulnerable&source=http_vulnerable6&tag=cve-2026-86218%2B&data_set=count&scale=log&auto_update=on\nTracker: https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=exchange&source=exchange6&source=http_vulnerable&source=http_vulnerable6&tag=cve-2026-86218%2B&dataset=unique_ips&limit=100&group_by=geo&stacking=stacked&auto_update=on\nIP data in Vulnerable HTTP reporting tagged 'cve-2026-86218': https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-http-report/\n218 out of 1399 seen in total. This is one week after exploitation activity was first reported publicly. \nPatch info: https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF4_Release_Notes.htm\nBackground on incidents: https://www.huntress.com/blog/n-able-vulnerability-exploitation", "creation_timestamp": "2026-09-12T19:02:04.235839Z"} 2026-09-12T19:02:04.235839+00:00 https://vulnerability.circl.lu/sighting/474fd8e9-ddf8-4b32-9ceb-a82da083add2/export 2026-09-14T12:23:18.558453+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "474fd8e9-ddf8-4b32-9ceb-a82da083add2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86218", "type": "seen", "source": "https://infosec.exchange/users/threatcodex/statuses/117259423199941188", "content": "CVE-2026-86218: Active Exploitation of N-able N-central: Critical Pre-Auth Remote Code Execution (RCE) Vulnerability#N_central #CVE_2026_86218 https://arcticwolf.com/resources/blog/cve-2026-86218/", "creation_timestamp": "2026-09-12T18:13:24.638477Z"} 2026-09-12T18:13:24.638477+00:00 https://vulnerability.circl.lu/sighting/9f90283e-0f52-457b-8e26-91cda3e9e553/export 2026-09-14T12:23:18.558547+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9f90283e-0f52-457b-8e26-91cda3e9e553", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86218", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102123", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-86218-N-central-IOC-Toolkit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jithinkrishnanrs\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-12 11:04:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDefensive IOC and detection toolkit for CVE-2026-86218, a critical pre-auth RCE in N-able N-central. Includes IOCs, log scanner, Sigma, Splunk, Elastic/KQL detections, and incident response guidance.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T12:00:05.752635Z"} 2026-09-12T12:00:05.752635+00:00 https://vulnerability.circl.lu/sighting/ebef52f8-01de-4674-ada7-a55cc852f484/export 2026-09-14T12:23:18.558649+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ebef52f8-01de-4674-ada7-a55cc852f484", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86218", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvc72idc2g2j", "content": "~Arcticwolf~\nActive exploitation enables unauthenticated takeover of N-central servers; patch to 2026.3.1.14+.\n-\nIOCs: CVE-2026-86218, CVE-2026-86206, CVE-2026-86207\n-\n#CVE202686218 #RCE #ThreatIntel", "creation_timestamp": "2026-09-12T04:01:21.216298Z"} 2026-09-12T04:01:21.216298+00:00