Loading story…
Rapid7 disclosed a chain of two vulnerabilities in N-able N-central that allows a remote unauthenticated attacker to create an attacker-controlled System administrator account. CVE-2026-86206, a medium-severity access-control flaw, stems from inconsistent URI and Forwarded header parsing between Envoy, Jetty, and N-central, enabling access to local-only SOAP services. CVE-2026-86207, rated high severity, bypasses legacy two-factor authentication; together, the flaws permit acquisition of a pre-login session, conversion to a privileged session for built-in accounts, and creation of a new privileged user.
The flaws constitute an authentication-bypass condition consistent with CWE-305 and affect all N-central releases before 2026.3 Hotfix 3 (2026.3.1.13). N-able has fixed the issues in that release; organizations operating on-premises N-central should apply the update urgently and review for unexpected privileged accounts or suspicious SOAP-service access. Hosted N-central customers do not need to take action because N-able has deployed the fixes.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Rapid7 publicly disclosed CVE-2026-86206 and CVE-2026-86207, which can be chained by a remote unauthenticated attacker to create an attacker-controlled System administrator account on affected N-central servers.
N-able released N-central 2026.3 Hotfix 3, version 2026.3.1.13, remediating CVE-2026-86206 and CVE-2026-86207. Versions earlier than 2026.3.1.13 are vulnerable to the chained attack.
Rapid7 provided N-able with technical analysis and an exploit script for the N-central vulnerability chain.
Rapid7 initially contacted N-able regarding the two vulnerabilities later designated CVE-2026-86206 and CVE-2026-86207.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
rapid7.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
N-able disclosed active exploitation of two related **authentication bypass** flaws in its N-central remote monitoring and management platform, `CVE-2026-18556` and the follow-on `CVE-2026-18577`, after determining the initial remediation was incomplete. The vulnerabilities, both mapped to **`CWE-288`**, allow unauthenticated attackers to take over administrative accounts on vulnerable N-central servers. N-able said attackers gained remote administrator access at a limited number of customer environments, while Huntress reported in-the-wild exploitation affecting both **cloud-hosted and on-premises** deployments and warned that many exposed servers remained unpatched. After compromising N-central, attackers abused the platform’s **Take Control** feature to pivot into managed customer endpoints and, in some cases, installed **Cloudflare Tunnel** services to maintain persistence even after server access was cut off. Reporting tied the incident to unusual licensing errors seen by some on-premises customers, and community discussions highlighted unexpected unlicensed-server status as a possible indicator. N-able released **version `2026.3.1.7`** as the first unaffected build and urged immediate upgrading, log review, IOC hunting, and inspection of downstream devices because patching the N-central server alone does not remove persistence already established on managed endpoints.
Sep 7, 2026
N-able released **N-central 2026.3 Hotfix 4** to remediate `CVE-2026-86218`, a maximum-severity pre-authentication remote-code-execution vulnerability in its on-premises N-central remote monitoring and management platform. An unauthenticated attacker can exploit internet-exposed, unpatched instances with low complexity to execute malicious code; deployments on Hotfix 3 remain vulnerable, and N-able urged immediate installation of Hotfix 4. N-able had not confirmed exploitation in production at the time of reporting, but Huntress identified a compromised customer environment and could not determine whether `CVE-2026-86218` or separately patched high-severity flaws `CVE-2026-86206` and `CVE-2026-86207` caused the intrusion because relevant logs had rotated. Shadowserver identified nearly 1,500 internet-exposed N-central servers, concentrated in the United States and Europe, leaving a substantial potential attack surface.
Sep 11, 2026
n8n published security advisories for multiple supported release branches after disclosure of several vulnerabilities, including a critical flaw tracked as **`CVE-2026-56348`**. The CVE affects versions before **`2.20.0`** and allows an authenticated user to abuse the **`POST /rest/dynamic-node-parameters/options`** endpoint to bypass **Allowed HTTP Request Domains** restrictions, causing the server to send credential-bearing HTTP requests to unauthorized hosts and potentially exfiltrate sensitive authentication data. The issue is remotely exploitable and impacts environments where users can access affected dynamic node functionality. The broader advisory set also covers additional n8n weaknesses in releases prior to **`2.28.1`**, **`2.27.4`**, and **`1.123.61`**, including another Allowed HTTP Request Domains bypass through the **AI Agents MCP Connector**, prototype pollution via workflow credentials that can lead to unauthenticated user and project enumeration, cross-issuer token exchange account binding caused by subject-only identity resolution, and a shared credential header leak through HTTP request pagination expressions. The Canadian Centre for Cyber Security urged administrators to review the advisories, upgrade to the patched versions, restrict access to exposed endpoints where possible, and monitor for unauthorized outbound requests that could indicate credential leakage.
Jun 29, 2026