Access Control Bypass Vulnerability in N-central by N-able
CVE-2026-86206

6.9MEDIUM

Key Information:

Vendor

N-able

Status
N-central
Vendor
CVE Published:
5 September 2026

What is CVE-2026-86206?

A vulnerability exists in the internal API access control filter of N-central that potentially allows unauthorized users to access sensitive internal APIs. This flaw highlights the importance of securing access controls to prevent unauthorized interactions with internal services. Users are urged to update to N-central versions 2026.3 HF3 or 2026.4, which contain fixes addressing this vulnerability.

Affected Version(s)

N-central 0 < 2026.3.1.13

References

https://documentation.n-able.com/N-central/Release_Notes/...
release-notes
https://me.n-able.com/s/security-advisory/aArVy0000002LTN...
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Tigges of Huntress
Rashmi Harish of Rapid7
.