CVE-2026-86206

www.tenable.com • September 7, 2026

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4

Published : 2026-09-05

Vector : CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in N-able N-central Requires Immediate Patching N-able has released Hotfix 4 for its N-central platform to address CVE-2026-86218, a critical remote code execution (RCE) vulnerability rated CVSS 10.0. This flaw allows unauthenticated attackers to execute arbitrary code on N-central servers running versions prior to 2026.3.1.14. The vulnerability has been reported as being actively exploited in the wild, raising urgent concerns among managed service providers (MSPs) and IT teams. N-able's communications have been inconsistent regarding whether the vulnerability has been confirmed as exploited, with some reports indicating it has been observed in active attacks. Organizations using on-premises N-central installations are urged to upgrade immediately to mitigate risks. The situation is compounded by a series of vulnerabilities disclosed in recent weeks, including CVE-2026-86206 and CVE-2026-86207, which also require urgent attention. The ongoing threat landscape necessitates vigilant monitoring and prompt patching of affected systems. 30 sources 80

Extracted Entities

CVEs (1)

CVE-2026-86206

CWE Weaknesses (1)

CWE-862 - Missing Authorization