CVE-2026-86206
published 2026-09-05CVE-2026-86206: A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and…
PriorityP179medium6.9CVSS 4.0
AVNACLATNPRNUINVCLVINVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.12%
65.8th percentile
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| n-able | n-central | < 2026.3.1.13 | 2026.3.1.13 |
CVSS provenance
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck6.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
N-able N-central prior 2026.3 HF3/2026.4 access control (EUVD-2026-72023)
vuldb·2026-09-05·CVSS 6.9
CVE-2026-86206 [MEDIUM] N-able N-central prior 2026.3 HF3/2026.4 access control (EUVD-2026-72023)
A vulnerability marked as very critical has been reported in N-able N-central. The affected element is an unknown function. This manipulation causes improper access controls.
This vulnerability is handled as CVE-2026-86206. The attack can be initiated remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs.
ghsa_unreviewed·2026-09-05
CVE-2026-86206 [MEDIUM] CWE-791 A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs.
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
VulnCheck
N-able N-central Incomplete Filtering of Special Elements
vulncheck·2026·CVSS 6.9
CVE-2026-86206 [MEDIUM] N-able N-central Incomplete Filtering of Special Elements
N-able N-central Incomplete Filtering of Special Elements
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
Affected: N-able N-central
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://previdian.com/CVE-2026-86206
No detection rules found.
Nuclei
N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing
nuclei·CVSS 6.9
CVE-2026-86206 [MEDIUM] N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing
N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
Template:
id: CVE-2026-86206
info:
name: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing
author: rapid7,DhiyaneshDk
severity: critical
description: |
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
impact: |
Unauthorised attackers can access internal APIs, potentially leading to data exposure or manipulation.
remediation: Update to version 2026.3 HF3 or 2026.4.
reference:
- https://www
Hackernews
N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
blogs_hackernews·2026-09-09·CVSS 6.9
CVE-2026-86218 [MEDIUM] N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 11, 2026.
The vulnerability in question is CVE-2026-86218 (CVSS score: 10.0), which has been described as a case of static code injection. It has been patched in N-central 2026.3 Hotfix 4 , released on September 5, 2026.
"N-able N-central contains a static code injection vulnerabilit
Rapid7
CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
blogs_rapid7·2026-09-08·CVSS 8.1
CVE-2026-18577 [HIGH] CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
## Overview
While conducting research into a recent N-able N-central authentication bypass vulnerability ( CVE-2026-18577 ), Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chained together, these two vulnerabilities allow a remote unauthenticated attacker to bypass authentication and create a new attacker-controlled System administrator account on an affected server.
CVE ID
Description
CWE
CVSSv4
CVE-2026-86206
Semicolon/Forwarded access-control bypass
CWE-791
6.9 (Medium)
CVE-2026-86207
UserTwoFactorLogin authentication bypass
CWE-305
7.7 (High)
Both CVE-2026-86206 and CVE-2026-86207 have been patched by the vendor via N-central 2026.3 Hotfix 3.
## Product description
N-able N-central is an enterprise-grade Remote Monitoring
Hackernews
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
blogs_hackernews·2026-09-07·CVSS 6.9
CVE-2026-86206 [MEDIUM] ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on.
Elsewhere, a trusted software source delivered code that stole credentials, and a protocol designed for secure network management gave outsiders useful clues before login. Add active attacks on browsers, routers, and online stores, and there’s plenty to check—even for teams that have k
Hackernews
N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
blogs_hackernews·2026-09-07·CVSS 10.0
CVE-2026-86218 [CRITICAL] N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed.
N-able has released its fourth hotfix in five weeks for the N-central remote monitoring and management (RMM) platform, this time for a maximum-severity vulnerability that could allow remote code execution on the N-central server without authentication.
The company's own communications disagree on whether the fl
2026-09-05
Published
Exploited in the wild