standard

CWE-96

Common Weakness Enumeration category for static code injection, where attacker-supplied input is written into code that the application later executes.

Known aliases

Static Code Injection

Relationships

No evidence-backed relationships are recorded.

Current clusters

security1 publisher

CISA put N-able's pre-auth N-central RCE on KEV three days after the hotfix shipped

CVE-2026-86218 lets an unauthenticated attacker run code on an N-central server with no user interaction. N-able fixed it in build 2026.3.1.14 and has already patched its own hosted instances.

Publishers:horizon3.ai

Reality

Evidence74
Adoption48
Hype gap+8
Incentives72
Confidence66

security7 publishers

CVE-2026-86218 gives unauthenticated attackers code execution on N-able N-central consoles

N-able shipped N-central 2026.3 HF4 on Saturday and says nothing confirms production exploitation, while Huntress calls the bug a possible zero-day and has one compromised customer console whose logs had already rotated.

Publishers:bleepingcomputer.comhelpnetsecurity.cominfosecurity-magazine.comn-able.comscworld.comsecurityweek.comthehackernews.com

Perspective Coverage

5 publishers

Builder: Builder 15%
Operator: Operator 74%
Investor: Investor 11%

Reality

Evidence74
Adoption42
Hype gap+16
Incentives58
Confidence71