N-able N-central Flaws Let Unauthenticated Attackers Create System Administrators

Rapid7 disclosed a chain of two vulnerabilities in N-able N-central that allows a remote unauthenticated attacker to create an attacker-controlled System administrator account. CVE-2026-86206, a medium-severity access-control flaw, stems from inconsistent URI and Forwarded header parsing between Envoy, Jetty, and N-central, enabling access to local-only SOAP services. CVE-2026-86207, rated high severity, bypasses legacy two-factor authentication; together, the flaws permit acquisition of a pre-login session, conversion to a privileged session for built-in accounts, and creation of a new privileged user.

The flaws constitute an authentication-bypass condition consistent with CWE-305 and affect all N-central releases before 2026.3 Hotfix 3 (2026.3.1.13). N-able has fixed the issues in that release; organizations operating on-premises N-central should apply the update urgently and review for unexpected privileged accounts or suspicious SOAP-service access. Hosted N-central customers do not need to take action because N-able has deployed the fixes.