336 N-able Matches, 93,431 ScreenConnect Matches and 183 Conductor Matches: Measuring the Managed Services Layer

Three products, three very different exposure counts, and a shared characteristic that matters more than any of the numbers: each one holds privileged access to systems its operator does not own.

The three products and why they are grouped

N-able N-central is a remote monitoring and management platform. CVE-2026-86218 is a static code injection flaw leading to pre-authentication remote code execution, CVSS 10.0, added to KEV on 8 September 2026.

ConnectWise ScreenConnect is a remote support tool. CVE-2026-84869 is a missing authorization flaw in active remote sessions that allows unauthorised file transfer and execution, with a CVSS score of 9.9. Huntress associated it with multiple incidents delivering malicious VBScript to newly connected hosts.

Orkes Conductor is a workflow orchestration engine. CVE-2026-58138 is a code injection and GraalVM sandbox escape in which an improperly configured HostAccess.ALL setting allows script code to reach Runtime.exec() through Java reflection. VulnCheck added it to KEV on 27 July 2026.

What the queries return

Query	Matches
app="N-able"	336
app="ScreenConnect"	93,431
app="Conductor"	183

The spread is wide, and each figure needs its own reading.

The N-able count of 336 is a vendor-level fingerprint rather than a product-specific one, so it may include other N-able products. It is also likely to undercount, because RMM platforms are frequently deployed on internal networks and behind authentication gateways.

The ScreenConnect count of 93,431 is the largest, which is consistent with remote support tooling being widely deployed and frequently internet-facing by design. Remote support tools need to be reachable so that technicians can connect to endpoints.

The Conductor count of 183 is small, which is consistent with a workflow engine used by a narrower set of organisations. It is worth noting that the Conductor OSS community edition API is reported to have no authentication by default, which means a small count does not imply a small per-instance risk.

The shared characteristic

What unites these three products is not their exposure count. It is that each one exists to give an operator privileged access to systems belonging to someone else. An RMM platform administers customer endpoints. A remote support tool connects to user machines. A workflow engine executes code against connected services.

That is why a vulnerability in any of them has a blast radius larger than the instance itself. For a managed service provider, the affected population is the customer base.

A practical method

1. Query each product specifically. Vendor-level fingerprints such as app="N-able" should be refined to the product where possible.
2. Verify version on instances you own. N-central's fixed version is 2026.3 Hotfix 4 (2026.3.1.14); ScreenConnect's is 26.6.5; Conductor's is 3.30.2 and above, with 3.30.0 and 3.30.1 described as partial fixes.
3. Map the blast radius before investigating. Enumerate which customer or internal environments each platform can reach. This is a prerequisite for scoping any incident.
4. Check for the specific artifacts. For ScreenConnect, audit session file transfer logs. For N-central, look for unexpected accounts and scheduled tasks.
5. Do not rely on patch status alone. Huntress reported a fully patched N-central instance that was still compromised, though the specific chain was not confirmed.

The general principle

When measuring exposure for management and orchestration platforms, the count is the least important number in the analysis. The important question is what the platform can reach if it is fully controlled, because that determines the consequences rather than the likelihood.

A platform with 183 instances that can execute code against connected services is a more significant exposure than its count suggests. A platform with 93,431 instances that can push files to endpoints is a more significant exposure than its count suggests in a different way. The counts describe how many doors exist; the architecture describes what is behind them.

References

• ZoomEye search results for app="N-able" (336), app="ScreenConnect" (93,431) and app="Conductor" (183), collected 23 September 2026
• N-able security advisory for CVE-2026-86218; ConnectWise advisory for CVE-2026-84869; Conductor advisory GHSA-7X5Q-8F6H-RJRC for CVE-2026-58138
• Huntress reporting on ScreenConnect and N-central exploitation
• CISA and VulnCheck Known Exploited Vulnerabilities records for the three CVEs