N-able N-central - Authentication Bypass
CVE-2026-86207
Verified
Description
An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal-only APIs.
Severity
Critical
CVSS Score
9.8
Exploit Probability
1%
Affected Product
n-central
Published Date
September 8, 2026
Template Author
rapid7, dhiyaneshdk
CVE-2026-86207.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-86207
CWE ID:
cwe-287
References
https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/https://me.n-able.com/s/security-advisory/aArVy0000002LTNKA2/cve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apishttps://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm
Remediation Steps
Upgrade N-able N-central to version 2026.3.1.13 (2026.3 Hotfix 3) or later.
Hosted N-central environments have already been patched by the vendor.