Loading vulnerability…
N-able N-central Internal API Access-Control Bypass
CVE-2026-86206 is an access-control bypass in N-able N-central's internal API access-control filter affecting versions before 2026.3.1.13. Inconsistent URI and Forwarded-header parsing across Envoy, Jetty, and N-central allows remote requests to reach SOAP interfaces intended to be accessible only locally. A semicolon-containing URI evades Envoy's protected-path rules but is normalized by Jetty to a protected endpoint. A malformed quoted Forwarded header is interpreted as loopback by Jetty, while N-central's LocalHostUtils validation fails open, allowing the request through ServletPathFilter. The vulnerability exposes protected internal APIs but does not itself authenticate a user. It can be chained with CVE-2026-86207 to obtain a privileged session and create an attacker-controlled System Administrator account.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can bypass network-origin and path-based restrictions protecting internal SOAP APIs. The standalone vulnerability has a CVSS v4.0 score of 6.9, with low confidentiality impact and no direct integrity or availability impact assigned. When chained with CVE-2026-86207, it can enable administrative account creation and full N-central platform control. Such administrative access can permit account and policy changes, script or software deployment, and remote-control activity across managed downstream endpoints. Exploitation of this specific vulnerability in the investigated production compromise was not conclusively established.
If you can’t patch tonight, do this now.
Until patched, restrict inbound access to N-central management and API interfaces to trusted administrative networks through IP allowlisting or a VPN, and segment the server from untrusted networks. Consider removing internet exposure until the update is installed. Monitor proxy and appliance logs for unusual internal API requests, URI-encoding anomalies, authentication irregularities, and unexpected administrative account or permission changes. These measures reduce exposure but do not correct the parsing discrepancies.
Patch, then assume compromise.
Upgrade the N-central server to 2026.3 Hotfix 3, build 2026.3.1.13, or a later fixed release; N-central 2026.4 also includes the fix. Prefer a current supported release incorporating all subsequent security updates. For the 2026.3 branch, Hotfix 4, build 2026.3.1.14, supersedes Hotfix 3 and additionally addresses the separate CVE-2026-86218 vulnerability. This is a server-side fix and does not require agent upgrades. N-able applied the fixes to hosted environments. If compromise is suspected, audit administrative accounts and permissions, remove unauthorized access, rotate affected credentials, and investigate the server and managed endpoints; patching does not remove existing attacker accounts.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.