Loading vulnerability…
Legacy Two-Factor Authentication Bypass in N-able N-central Internal APIs
CVE-2026-86207 is a high-severity authentication bypass affecting internal-only APIs in N-able N-central versions before 2026.3 Hotfix 3, build 2026.3.1.13. The UserTwoFactorLogin method binds a supplied user identity to a pre-login session before validating legacy profile-based two-factor authentication. If legacy authentication processing raises an exception, the identity binding remains instead of being invalidated. For certain built-in privileged identities, a dummy-password authentication request can consequently convert the session into an authenticated privileged SOAP session. The flaw concerns legacy AuthAnvil and RSA SecurID integration, rather than native TOTP Two-Step Verification. Chaining it with CVE-2026-86206 allows a remote unauthenticated attacker to reach protected SOAP services and create a System Administrator account. The vulnerability has a CVSS v4.0 score of 7.7.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of the N-central platform by granting privileged API access. When chained with CVE-2026-86206, it enables unauthenticated platform takeover through creation of an attacker-controlled System Administrator account. Administrative control can subsequently enable account and policy manipulation, script and job distribution, and remote-control activity across managed endpoints, potentially affecting multiple downstream customer environments. Production exploitation of this specific CVE was not conclusively established; reproduction of the authentication-bypass chain did not establish which vulnerability enabled the investigated compromise.
If you can’t patch tonight, do this now.
Until patching is complete, restrict management-console and API access to trusted administrative networks through IP allowlisting or a VPN, and segment the N-central server. Consider removing internet exposure until the update is installed. Monitor privileged API activity, authentication anomalies, unexpected administrative accounts, permission changes, and unexplained remote-control sessions. MFA is not a substitute for patching this authentication-bypass vulnerability.
Patch, then assume compromise.
Upgrade the N-central server to at least 2026.3 Hotfix 3, build 2026.3.1.13, which fixes CVE-2026-86207 and CVE-2026-86206. Prefer Hotfix 4, build 2026.3.1.14, or a later supported release because it supersedes Hotfix 3 and also addresses the separate CVE-2026-86218 remote code execution vulnerability. Verify the running server build after upgrading. Agent upgrades are not required for these server-side fixes. N-able applied the fixes to hosted environments. If compromise is suspected, investigate unauthorized accounts and permission changes, rotate administrator and service credentials, and assess managed endpoints; patching alone does not remove attacker-created persistence.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.