Two N-able N-central Flaws Allow Unauthenticated Attackers to Create Administrator Accounts
Summary
Rapid7 disclosed two N-central vulnerabilities that can be chained to bypass authentication and create a privileged account. All versions before 2026.3.1.13 are affected; hosted customers have already been updated.
Key points
- CVE-2026-86206 and CVE-2026-86207 can be chained to let a remote unauthenticated attacker gain a privileged SOAP session and create a System administrator account.
- CVE-2026-86206 combines a semicolon-based path parsing discrepancy with a crafted Forwarded header to bypass access controls.
- CVE-2026-86207 leaves a requested user ID bound to a session when an exception interrupts legacy two-factor authentication.
- The flaw can affect built-in identities including N-able Administrator, Product Administrator, and N-able Support.
- All N-central versions before 2026.3.1.13 are vulnerable; the issues are fixed in N-central 2026.3 Hotfix 3.
- On-premise customers should urgently apply the update; hosted N-central environments have already been patched.
Article Details
- Vulnerability Types
- Access-control bypass
- Authentication bypass
- Severity
- CVE-2026-86206: CVSSv4 6.9 (Medium); CVE-2026-86207: CVSSv4 7.7 (High)
- Affected Versions
- All N-central versions prior to 2026.3.1.13
- Exploitation Status
- unknown
- Exploit Availability
- public_exploit
- Patch Status
- available
CVE
People
Vendors
Products
AuthAnvilsupports two distinct second-factor systems: legacy, profile-based authentication using an external AuthAnvil or RSA SecurID server, and native time-based one-time password (TOTP) “Two-Step Verification” using anEnvoyN-central exposes its management interface (TCP 8443 by default) through Envoy, an edge proxy. Envoy passes accepted requests to Jetty, the Java web server that hosts N-central's application. The application givesJettyinterface (TCP 8443 by default) through Envoy, an edge proxy. Envoy passes accepted requests to Jetty, the Java web server that hosts N-central's application. The application gives requests from the loopbackN-centralWhile conducting research into a recent N-able N-central authentication bypass vulnerability (CVE-2026-18577), Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chainedRSA SecurIDdistinct second-factor systems: legacy, profile-based authentication using an external AuthAnvil or RSA SecurID server, and native time-based one-time password (TOTP) “Two-Step Verification” using an authenticator