CVE-2026-86206 PUBLISHED

Access control filter bypass allows unauthorised access to APIs

Assigner: N-able
Reserved: 05.09.2026 Published: 05.09.2026 Updated: 05.09.2026

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	Low	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	N-able
Product	N-central
Versions	Default: unaffected affected from 0 to 2026.3.1.13 (excl.)

Credits

Michael Tigges of Huntress finder
Rashmi Harish of Rapid7 finder

References

Problem Types

CWE-791 Incomplete filtering of special elements CWE

Impacts

CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters