Weekly Threat Bulletin – September 9th, 2026

N-able Patches Max-Severity N-central RCE Flaw (CVE-2026-86218) Amid Potential Zero-Day Exploitation

N-able has released N-central 2026.3 Hotfix 4 to address a maximum-severity remote code execution (RCE) vulnerability, tracked as CVE-2026-86218, affecting its N-central remote monitoring and management (RMM) platform. This low-complexity flaw allows unauthenticated threat actors to execute malicious code on internet-exposed N-central instances, of which nearly 1,500 are currently exposed online, primarily across the United States and Europe. While N-able has not officially confirmed active exploitation in production environments, cybersecurity firm Huntress has flagged CVE-2026-86218 as a potential zero-day. This vulnerability was patched alongside two other high-severity flaws, CVE-2026-86206 and CVE-2026-86207, which allow attackers to bypass authentication and gain full access to the platform. On-premises administrators are urged to apply the hotfix immediately to mitigate the risk of compromise, especially given historical targeting of N-central vulnerabilities.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately upgrade all on-premises N-able N-central instances to version 2026.3 Hotfix 4 or a later version to patch vulnerabilities CVE-2026-86218, CVE-2026-86206, and CVE-2026-86207.
• If immediate patching is not possible, restrict all internet access to the N-able N-central management console using firewall rules. Only allow access from trusted, specified IP addresses.
• If immediate patching is not possible, enforce the use of a Virtual Private Network (VPN) with multi-factor authentication for all remote access to the N-able N-central management console.
• Hunt for indicators of compromise by reviewing N-central server logs for signs of unauthorized access, unexpected account creation, or anomalous API activity, especially before applying the patch.

Compliance Best Practices

• Implement a continuous attack surface management program to regularly identify, inventory, and review all internet-facing systems and services, ensuring that management platforms like N-central are not unnecessarily exposed.
• Isolate critical infrastructure management platforms like N-able N-central into a secure, segmented network zone with strict ingress and egress filtering to limit the blast radius in case of a compromise.
• Establish a third-party risk management program to regularly audit the security posture and patch management compliance of all managed service providers (MSPs) and critical software vendors.
• Develop and enforce a comprehensive vulnerability management policy that defines strict timelines for patching systems based on severity, with specific, accelerated SLAs for critical, internet-facing platforms like N-central.

ConnectWise ScreenConnect File Transfer Flaw Exploited to Deploy VBScript Malware

ConnectWise has confirmed a file transfer vulnerability affecting both Cloud and On-Premise deployments of ScreenConnect Remote Access Support and Access sessions. To mitigate this risk prior to the release of an official patch and CVE identifier, administrators should immediately disable file transfers by deselecting the `TransferFiles` (or legacy `TransferFilesInSession`) permission under the security roles configuration. This flaw is linked to observed campaigns where social engineering is used to deploy rogue ScreenConnect clients that spawn Windows Script Host processes to execute four VBScript payloads (`1.vbs` through `4.vbs`) and establish persistence via a `WindowsServiceHost` registry Run Key pointing to the user's AppData directory. These scripts enable worm-like propagation to connected endpoints, system discovery, tunneling, security-control modifications, and cryptocurrency mining. Defenders should inspect ScreenConnect audit logs for unauthorized `RunFiles` or `RanFiles` entries tied to guest processes and reimage any compromised systems.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• In your ScreenConnect instance, navigate to Administration > Security > Roles, edit each assigned role, and deselect the 'TransferFiles' (or 'TransferFilesInSession' for legacy versions) permission for all session groups.
• Monitor for the release of the official fix from ConnectWise for the ScreenConnect file transfer flaw and apply the patch to all on-premise instances immediately upon availability.
• Review ScreenConnect audit logs for any 'RunFiles' or 'RanFiles' entries associated with a guest process, which could indicate malicious file execution.
• Scan the Windows Registry on all endpoints for a Run Key named 'WindowsServiceHost', particularly looking for entries that point to script files in user 'AppData' directories.
• Use your endpoint security tools to search all systems for the presence of VBScript files named '1.vbs', '2.vbs', '3.vbs', or '4.vbs', especially in user profile directories.
• If any endpoints show signs of compromise based on the indicators in the article, immediately isolate them from the network and reimage them using a trusted, known-good operating system image.

Compliance Best Practices

• Develop and implement a continuous security awareness training program focusing on identifying and reporting social engineering attempts, such as phishing emails or fraudulent support calls that trick users into installing unauthorized remote access software.
• Implement an application allowlisting policy to prevent the execution of unauthorized software, including unapproved remote management tools like rogue ScreenConnect clients.
• Configure endpoint policies to disable or restrict Windows Script Host (wscript.exe/cscript.exe) for all users and systems that do not have a legitimate business need for it.
• Establish a quarterly review process for all Remote Monitoring and Management (RMM) tools, including ScreenConnect, to audit user roles, permissions, and security settings, ensuring adherence to the principle of least privilege.
• Tune your Endpoint Detection and Response (EDR) platform to generate high-severity alerts for suspicious process chains, such as a remote management tool spawning Windows Script Host (wscript.exe) which then writes files or modifies registry run keys.

MikroTik RouterOS Targeted by MikroTrick Zero-Day (CVE-2026-67276, CVE-2026-86060) for SSH Router Takeover

Active exploitation of a high-severity two-stage attack chain, dubbed MikroTrick, targets internet-facing MikroTik RouterOS devices to achieve full administrative takeover. The chain combines CVE-2026-67276 (CVSS 9.2), an SSH public-key authentication bypass caused by incomplete RSA key validation (CWE-347), with CVE-2026-86060, an SSH privilege-escalation vulnerability triggered by specially crafted usernames. Exploitation began as a zero-day on September 2, 2026, affecting RouterOS versions 7.24 before 7.24.2, 7.0.0 before 7.23.4, and 6.0.0 before 6.49.21. Attackers utilize malicious IPs `82.192.72[.]4` and `103.102.31[.]18` to create highly privileged accounts, such as "ops", leaving distinct log artifacts containing the string "ssh:-2". To mitigate this threat, administrators must immediately upgrade to RouterOS versions 7.25 beta 3, 7.24.2, 7.23.5, or 6.49.21 or later, restrict SSH access to trusted networks, and run `/system/device-mode/print` to check for a "Flagged" compromise status. If compromise is detected, devices should be isolated, factory reset, configurations rebuilt from trusted sources, and all credentials rotated.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Identify all MikroTik devices in the environment and upgrade them to a patched RouterOS version: 6.49.21 or later, 7.23.5 or later, or 7.24.2 or later.
• Block all inbound and outbound traffic to and from the IP addresses 82.192.72.4 and 103.102.31.18 at the network firewall.
• Review logs on all MikroTik routers for entries containing 'login failure for user -2' or 'user <name> added by ssh:-2@'. Concurrently, inspect user lists for an account named 'ops' or any other unexpected accounts.
• For any MikroTik router that cannot be patched immediately, use firewall rules to block all public internet access to the SSH (port 22), WWW/WWW-SSL (ports 80/443), and bandwidth-test server services.
• If a device shows any sign of compromise, immediately isolate it from the network, perform a factory reset, and manually rebuild the configuration from a known-good, verified template. Do not restore from a potentially compromised backup file.
• For any device confirmed or suspected to be compromised, immediately rotate all passwords, SSH keys, API credentials, and other secrets stored on or used to access the device.

Compliance Best Practices

• Design and implement a network security policy that prohibits exposing management interfaces (including SSH, WinBox, and WebFig) of critical network infrastructure directly to the internet. Enforce the use of a secure VPN or a dedicated management VLAN for all administrative access.
• Establish a secure, version-controlled repository for storing golden-image configurations for all network devices. Implement a process to regularly audit these configurations and use them as the sole source for rebuilding devices.
• Implement a formal vulnerability management program that includes maintaining a comprehensive asset inventory, subscribing to vendor security advisories, and establishing strict Service Level Agreements (SLAs) for patching critical vulnerabilities on edge devices.
• Deploy centralized logging for all network infrastructure, forwarding device logs to a SIEM. Develop and implement detection rules to automatically generate alerts for suspicious configuration changes, the creation of new user accounts, and other anomalous activities on network devices.

Google Chrome Zero-Day (CVE-2026-85046) in V8 JavaScript Engine Actively Exploited

Google has released security updates to address 12 vulnerabilities in the Chrome browser, highlighted by a zero-day vulnerability tracked as CVE-2026-85046. This vulnerability is a type confusion flaw in the V8 JavaScript engine that is actively being exploited in the wild, prompting the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities Catalog with a remediation deadline of September 18, 2026. The update also addresses 11 other security flaws, including out-of-bounds read/write issues, use-after-free vulnerabilities, and race conditions across various components such as CrashReporting (CVE-2026-85052), Network (CVE-2026-85043), Compositing (CVE-2026-85048, CVE-2026-85051), V8 (CVE-2026-85045), WebGL (CVE-2026-85050), CacheStorage (CVE-2026-85053), DevTools (CVE-2026-85042), Skia (CVE-2026-85049), Transactions Platform (CVE-2026-85047), and Mobile (CVE-2026-85044). To mitigate these risks, users running Google Chrome versions prior to 152.0.7977.82/.83 must upgrade to the stable channel version 152.0.7977.82/.83 for Windows and Mac, or 152.0.7977.82 for Linux.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Update all Google Chrome installations on Windows, macOS, and Linux endpoints to version 152.0.7977.82/.83 or newer to mitigate CVE-2026-85046 and the other 11 vulnerabilities addressed in the release.
• Use your vulnerability management platform to scan all endpoints and servers to identify any instances of Google Chrome with versions prior to 152.0.7977.82/.83.
• Communicate to all employees the need to restart their Google Chrome browser to apply the critical security update and instruct them on how to verify their browser version.

Compliance Best Practices

• Implement an automated, centralized patch management system for third-party applications, focusing on web browsers, to ensure rapid deployment of critical security updates and reduce the window of exposure for future zero-day vulnerabilities.
• Establish a corporate policy that standardizes the use of a single, approved web browser across the organization to streamline security management, patching, and configuration.
• Review and tune Endpoint Detection and Response (EDR) rules to specifically monitor for and alert on suspicious child processes or script execution originating from browser processes like chrome.exe.

StyleSmuggler: Magento and Adobe Commerce Zero-Day RCE Under Active Attack

An unpatched zero-day remote code execution vulnerability, known as StyleSmuggler, is actively targeting Magento and Adobe Commerce installations, including versions 2.4.6-p15, 2.4.7, 2.4.8, and 2.4.9. The exploit chain bypasses existing safeguards by injecting malicious PHP code into the template system using style properties, which is then executed via a failed payment email. To mitigate this threat prior to an official patch, administrators can temporarily disable GraphQL. Indicators of compromise include a malicious background process disguised as `[kworker/u:8:0]`, crontab persistence executing `~/.local/share/.gvfsd/gvfsd-user` every five minutes, and files located in `/tmp/.kw_<random>` and `~/.local/share/.gvfsd/`. Network indicators include the malware download host `247.cdnflare.xyz`, command-and-control IP `99.84.67.186:443` utilizing WebSocket over TLS, and attacker source IP `88.216.72.181`. The associated payload hash is `e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7`, and malicious HTTP traffic features POST requests to `/paypal/transparent/response/` containing base64-encoded PHP eval code, GET requests to `/customer/section/load/`, and POST requests to `/graphql` utilizing style parameters.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Temporarily disable the GraphQL endpoint on all public-facing Magento and Adobe Commerce servers.
• Add the domain '247.cdnflare.xyz' and IP addresses '99.84.67.186' and '88.216.72.181' to the network firewall blocklist.
• Scan all Magento and Adobe Commerce servers for a running process named '[kworker/u:8:0]' and terminate it immediately if found.
• Scan server filesystems for the following malicious files and directories and remove them if found: '/tmp/.kw_*', '~/.local/share/.gvfsd/gvfsd-user', and '~/.local/share/.gvfsd/.gvfsd_<8hex>.lock'.
• Inspect all user crontab entries for persistence mechanisms executing '~/.local/share/.gvfsd/gvfsd-user' and remove any malicious entries found.
• Search web server access logs for requests matching the patterns 'POST /graphql?styles[....]=' or 'POST /paypal/transparent/response/?<=eval' to identify compromised systems.
• If any indicators of compromise are discovered on a server, immediately rotate all Magento application credentials, including admin passwords and database keys.
• Prepare for an emergency deployment of the official Adobe security patch for the StyleSmuggler vulnerability as soon as it becomes available.

Compliance Best Practices

• Evaluate and deploy a Web Application Firewall (WAF) to provide virtual patching and protect web applications from zero-day exploits.
• Implement a File Integrity Monitoring (FIM) solution on web servers to alert on unauthorized file creation or modification in sensitive directories.
• Configure server monitoring and Endpoint Detection and Response (EDR) tools to generate alerts for the creation of new cron jobs and for processes with suspicious or masqueraded names.
• Develop and formalize an incident response plan specifically for zero-day vulnerabilities, including procedures for applying temporary mitigations like disabling application features and performing emergency patching.
• Conduct a security review and harden server configurations to ensure the web server process runs with the principle of least privilege, restricting its ability to write to non-essential directories or modify system configurations like crontab.