Access Control Bypass Vulnerability in N-central by N-able
CVE-2026-86206

6.9MEDIUM

Key Information:

Vendor: N-able
Status: N-central
Vendor: CVE Published:; 5 September 2026

Badges

📰 News Worthy

What is CVE-2026-86206?

A vulnerability exists in the internal API access control filter of N-central that potentially allows unauthorized users to access sensitive internal APIs. This flaw highlights the importance of securing access controls to prevent unauthorized interactions with internal services. Users are urged to update to N-central versions 2026.3 HF3 or 2026.4, which contain fixes addressing this vulnerability.

Affected Version(s)

N-central 0 < 2026.3.1.13

News Articles

The Hacker News

CVE-2026-86218 CVE-2026-86206

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

N-able patches a critical N-central flaw that could allow unauthenticated remote code execution, but its exploitation statements conflict.

3 weeks ago

BleepingComputer

CVE-2026-86218 CVE-2026-86206

N-able patches max severity N-central flaw amid ongoing attacks

N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform.

3 weeks ago