CVE-2026-86218 Microsoft Sentinel · KQL

Detect N-able N-central Pre-Authentication Static Code Injection RCE (CVE-2026-86218) in Microsoft Sentinel

Detects exploitation of CVE-2026-86218, a pre-authentication remote code execution vulnerability in N-able N-central caused by static code injection (CWE-96) where attacker-controlled input is evaluated as code by the N-central server. Listed in CISA KEV. This detection looks for anomalous unauthenticated requests to N-central web endpoints followed by child-process spawns from the N-central application/Apache/Java service accounts, injected payload markers in HTTP request bodies, and web-server processes launching shells or interpreters — the hallmarks of code-injection RCE against an Internet-exposed RMM server.

MITRE ATT&CK

Tactic
Initial Access Execution

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let ncentralHosts = dynamic([]);
union isfuzzy=true
(
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("java.exe","java","httpd","httpd.exe","apache2","nginx","tomcat9.exe","catalina.sh","w3wp.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","dash","python","python3","perl","nc","ncat","curl","wget","whoami","id")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
),
(
DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("java.exe","java","httpd","apache2","tomcat9.exe")
| where RemotePort in (4444,1337,9001,53,80,443) and ActionType == "ConnectionSuccess"
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| sort by Timestamp desc
critical severity medium confidence

Surfaces N-central server (Java/Tomcat/Apache) processes spawning shells, interpreters, or network tooling — indicative of static-code-injection RCE — plus outbound connections from the app service to common reverse-shell ports.

Data Sources

Microsoft Defender for EndpointDeviceProcessEventsDeviceNetworkEvents

Required Tables

DeviceProcessEventsDeviceNetworkEvents

False Positives & Tuning

  • Legitimate N-central maintenance or patch scripts that shell out from the Java service account during upgrades
  • Administrator-run diagnostic commands executed on the N-central appliance
  • Backup or monitoring agents that spawn shells from web-tier processes

Other platforms for CVE-2026-86218

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Java app-tier spawning a shell (Linux)

    Expected signal: Process-creation event with parent named 'java' spawning /bin/bash executing id/whoami.

  2. Test 2Simulate web-tier reverse-shell attempt (Linux)

    Expected signal: Network-connection event from a tomcat-named process to port 4444.

  3. Test 3Simulate Tomcat spawning PowerShell (Windows)

    Expected signal: ProcessRollup2/Sysmon EventID 1 showing tomcat9.exe parent launching powershell.exe running whoami.

Last updated: 2026-09-09 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the N-central version and hotfix level on the affected appliance; determine whether it is patched to 2026.3 Hotfix 4 or later per the N-able advisory for CVE-2026-86218.
  2. Determine whether the N-central web interface is Internet-exposed and review web-server/reverse-proxy logs for anomalous unauthenticated POST requests immediately preceding the flagged child-process spawn.
  3. Correlate the parent Java/Tomcat/Apache process and its spawned child (shell/interpreter/LOLBin), capturing full command lines, executing user, and timestamps to establish whether execution was operator-driven or injected.
  4. Check for new or modified files (webshells, cron entries, systemd units) written by the N-central service account around the event time.

Containment

  1. Isolate the N-central appliance from the network (or restrict inbound to management IPs only) to halt further pre-auth exploitation and any active reverse shell.
  2. Apply N-able N-central 2026.3 Hotfix 4 (or the vendor-directed fixed release) addressing CVE-2026-86218; if patching must wait, place the web interface behind VPN/allow-list access.
  3. Rotate N-central service credentials, agent registration tokens, and any managed-endpoint secrets reachable from the compromised RMM server.

Evidence Collection

  1. Preserve web-server/reverse-proxy access and error logs, the Tomcat/Java application logs, and auditd/Sysmon process-creation records covering the exploitation window.
  2. Capture a forensic image or at minimum the process memory of the running Java service and copies of any dropped payloads/webshells before remediation.
  3. Export EDR process-tree and network-connection telemetry for the parent app process and all descendant processes.

Escalation Criteria

  • !Escalate to incident response if a child shell, reverse-shell connection, dropped webshell, or persistence artifact is confirmed on the appliance.
  • !Escalate to major-incident/customer-notification if the compromised N-central server pushed commands or scripts to downstream managed endpoints, indicating supply-chain-style spread through the RMM.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Tomcat/Java application and web-server access logs showing the malicious unauthenticated request
  • >Process-creation records (auditd/Sysmon/EDR) linking the app-tier parent to shell children
  • >Newly written files in N-central web directories or service-account-owned paths (potential webshells)
  • >Outbound connection logs from the Java service to attacker infrastructure

Tuning Guidance

Baseline the legitimate shell/helper invocations produced by N-central's own upgrade and maintenance routines from the service account, then exclude those specific parent-child command-line patterns. Restrict the parent-process list to the actual JVM/web binaries on your appliance and scope by the known N-central host(s) to cut noise. Alert with high urgency when the child process is an interactive shell, network utility, or connects outbound to an uncommon port shortly after an unauthenticated web request.

Hunting Queries

Hunt for N-central application-tier processes spawning shells or download utilities across the estate, grouped by host and account.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName in~ ("java","java.exe","httpd","apache2","tomcat9.exe") | where FileName in~ ("sh","bash","cmd.exe","powershell.exe","python","python3","curl","wget","nc","whoami") | summarize count() by DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, bin(Timestamp, 1h)
Hunting — SPL
spl 
index=* (sourcetype=linux:audit OR sourcetype=Sysmon) | eval p=lower(coalesce(parent_process_name,ParentImage)), c=lower(coalesce(process_name,Image)) | where (like(p,"%java%") OR like(p,"%tomcat%") OR like(p,"%apache2%")) AND (like(c,"%sh") OR like(c,"%python%") OR like(c,"%curl%") OR like(c,"%wget%")) | stats count by host,user,c

Atomic Red Team Tests

Test 1 Simulate Java app-tier spawning a shell (Linux)
linux

Emulates an N-central Java/Tomcat process spawning a shell as would occur after static code injection, generating parent-child process telemetry.

Command

bash 
cp /usr/bin/sleep /tmp/java && /tmp/java 1 & sleep 0.2; /bin/bash -c 'id; whoami'

Cleanup

bash 
rm -f /tmp/java

Expected Telemetry

Process-creation event with parent named 'java' spawning /bin/bash executing id/whoami.

Expected Detection

The KQL/SPL/EQL rules match a java parent spawning bash running whoami/id.

Test 2 Simulate web-tier reverse-shell attempt (Linux)
linux

Emulates an injected payload opening an outbound connection from the app tier to a listener on a common reverse-shell port.

Command

bash 
cp /usr/bin/bash /tmp/tomcat 2>/dev/null; /tmp/tomcat -c 'exec 3<>/dev/tcp/127.0.0.1/4444; echo test >&3' 2>/dev/null || true

Cleanup

bash 
rm -f /tmp/tomcat

Expected Telemetry

Network-connection event from a tomcat-named process to port 4444.

Expected Detection

DeviceNetworkEvents / SPL network stanza flags app-tier process connecting to reverse-shell port 4444.

Test 3 Simulate Tomcat spawning PowerShell (Windows)
windows

Emulates a Windows-hosted N-central web process launching PowerShell to run reconnaissance, as after code-injection RCE.

Command

powershell 
copy C:\Windows\System32\cmd.exe %TEMP%\tomcat9.exe >nul & %TEMP%\tomcat9.exe /c "powershell -Command whoami"

Cleanup

powershell 
del %TEMP%\tomcat9.exe

Expected Telemetry

ProcessRollup2/Sysmon EventID 1 showing tomcat9.exe parent launching powershell.exe running whoami.

Expected Detection

KQL, CQL, and EQL rules match a tomcat/w3wp parent spawning powershell/cmd.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections