CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.
Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.
- Chained CVE-2026-86206 and CVE-2026-86207 yield unauthenticated System admin on N-central.
- Semicolon path trick bypasses Envoy prefix rules; crafted Forwarded header fakes loopback to Jetty.
- Affects the N-central RMM platform used by MSPs; fixed in 2026.3 Hotfix 3.
- Follows Rapid7's earlier disclosure of the CVE-2026-18577 N-central authentication bypass.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-18577 | Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch) | 8.2 | 15% | KEV | KEV |
CVE-2026-86207+1 related CVE | Authentication bypass in N-able N-central internal APIs before 2026.3 HF 3 | 7.7 group max | <1% |
From the original article
7 min read at rapid7.comOverview While conducting research into a recent N-able N-central authentication bypass vulnerability (CVE-2026-18577), Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chained together, these two vulnerabilities allow a remote unauthenticated attacker to bypass authentication and create a new attacker-controlled System administrator account on an affected server.
By Stephen Fewer · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.