CVE-2026-86207

Authentication bypass leads to unauthorised access to N-central

No known exploitation. EPSS puts it in the 69th percentile. Fixed in 2026.3.1.13.

CVSS —Not scored EPSS percentile69th1.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix2026.3.1.13Upgrade to this build

Published 2026-09-05Updated 2026-09-08Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

N-able N-centralAffected: < 2026.3.1.13Upgrade to: 2026.3.1.13Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your N-central version and whether you are running a build before 2026.3.1.13.
If you are below 2026.3.1.13, schedule an upgrade immediately to N-central fixed version 2026.3.1.13.
After upgrading, re-verify the N-central version shows 2026.3.1.13 (or newer) and that the internal-only APIs are not reachable from untrusted networks.
Review recent access logs for unusual requests to internal-only API endpoints around the time you last checked your system.

Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

2 publishers

Exploitation reported in the wild
as reported · Sep 9, 2026·The Hacker News summary

Sourced from public security reporting — each date is when it was published, not when it happened. 3 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs

In plain language

Written by AI from the record

CVE-2026-86207 is a weakness in N-central that can let an attacker get into the system without logging in properly, so a typical small business running N-central should fix it as a priority.

CVE-2026-86207 is an authentication bypass in N-central (N-central < 2026.3 HF 3) that can allow unauthorized access to internal-only APIs, with recent reporting suggesting active exploitation.

If you're affected

Unauthorized system access
Malicious configuration changes
Service disruption
Exposure of managed device data

What is it

Think of N-central like a building with a front door that’s supposed to require a key (login). This bug acts like a “key that isn’t actually needed” for a certain set of internal doors (internal-only APIs), which means someone may be able to get in without proper authentication. If an attacker can reach those doors, they may be able to change things or disrupt your managed IT environment.

Who is affected

This matters if you run N-central and your version is older than the fixed release mentioned below. It’s mainly a risk through the internal-only APIs, so it depends on whether an attacker can reach those parts of your network. Treat it as urgent if your N-central is reachable from the internet or from any untrusted network paths (for example, misconfigured routing, VPN access, or exposed admin connectivity).

How urgent is it

This is RED because recent reporting indicates exploitation activity for an authentication bypass in N-central. If an attacker can reach the affected internal-only API functions, they can potentially gain unauthorized access without valid logins—so waiting increases the chance of compromise.

What to do — in detail

Confirm exposure

Log into your N-central admin console and locate the software version.
Determine whether your installed version is earlier than the fixed release (fixed in 2026.3.1.13).

Upgrade to the fixed version

Plan a maintenance window for upgrading N-central.
Upgrade N-central to 2026.3.1.13 (or later if your vendor provides a newer patch line).
After the upgrade, re-check the N-central version to confirm it is 2026.3.1.13 or newer.

Network reachability check (important for this bug)

Verify that N-central internal-only API endpoints are not reachable from untrusted networks.
Confirm firewall rules restrict management/API access to only trusted sources (for example, your admin machines, approved VPN users, and internal networks).

If you can’t patch immediately (temporary containment)

Immediately restrict network access to N-central so that only trusted admin locations can reach the relevant service endpoints.
If N-central is exposed through any public routing, remove/disable that exposure until upgraded.

What to monitor after patching

Check access logs for unusual activity targeting internal-only API paths (unexpected clients, repeated failures, odd request patterns).
Look for unexpected admin actions shortly after suspicious access windows.

KEV timing

CISA KEV was not listed for this CVE in the provided findings, so your action should rely on the fix availability and the reported exploitation pressure rather than KEV presence.

Technical context

CVE-2026-86207 is a CWE-305 (authentication bypass) affecting N-central. The described issue is that N-central versions earlier than 2026.3 HF 3 can be tricked into treating requests to internal-only APIs as authenticated, enabling unauthorized access to functions behind those API surfaces. The fix is provided as N-central fixed in 2026.3.1.13. Based on the findings, press attention indicates exploitation is occurring (even though this CVE is not listed in CISA KEV in the supplied data). EPSS is reported as a low predicted likelihood, but the verdict for this CVE is RED due to active exploitation signals. For incident monitoring, focus on request patterns and access attempts to internal-only API endpoints from sources that shouldn’t be able to reach them.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS69th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.3% chance of exploitation activity in the next 30 days, which ranks it in the 69th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 8 days, from the signal feeds we watch.

2026-09-13Analysis publishedN-able Told Its Customers It Was a Zero-Day. Its Own Release Notes Said No One Had Seen It Exploited.
2026-09-10OpenVAS check added
2026-09-09Nuclei check added
2026-09-08Record updated
2026-09-05Publishedweakness classified, record updated