{"id":"CVE-2026-86206","title":"A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs","summary":"A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-791"],"vendor":"N-able","product":"N-central","affected":["N-central < 2026.3.1.13"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:16:41.410","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86206","references":[{"url":"https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm","label":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"},{"url":"https://me.n-able.com/s/security-advisory/aArVy0000002LTNKA2/cve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apis","label":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00676,"epssPercentile":0.50423,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-08T10:29:40.266568Z"},"cvssSource":"cna","ingestedAt":"2026-09-06T13:55:47.750Z","exploits":{"nuclei":["CVE-2026-86206"],"checkedAt":"2026-09-21T15:31:02.116Z"},"exploitAvailable":true,"slug":"CVE-2026-86206","body":"## Overview\n\nA vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":50,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":202085,"id":"CVE-2026-86206","ts":1789400048242,"field":"exploit_available","old":"false","new":"true"},{"seq":200812,"id":"CVE-2026-86206","ts":1789397616343,"field":"exploit_available","old":"true","new":"false"},{"seq":199505,"id":"CVE-2026-86206","ts":1789395528878,"field":"exploit_available","old":"false","new":"true"},{"seq":198750,"id":"CVE-2026-86206","ts":1789392244039,"field":"exploit_available","old":"true","new":"false"},{"seq":197083,"id":"CVE-2026-86206","ts":1789384292379,"field":"exploit_available","old":"false","new":"true"},{"seq":194212,"id":"CVE-2026-86206","ts":1789378783008,"field":"exploit_available","old":"true","new":"false"},{"seq":192999,"id":"CVE-2026-86206","ts":1789376515056,"field":"exploit_available","old":"false","new":"true"},{"seq":191786,"id":"CVE-2026-86206","ts":1789373631037,"field":"exploit_available","old":"true","new":"false"},{"seq":190571,"id":"CVE-2026-86206","ts":1789369475517,"field":"exploit_available","old":"false","new":"true"},{"seq":189358,"id":"CVE-2026-86206","ts":1789368412843,"field":"exploit_available","old":"true","new":"false"},{"seq":188141,"id":"CVE-2026-86206","ts":1789365230743,"field":"exploit_available","old":"false","new":"true"},{"seq":186928,"id":"CVE-2026-86206","ts":1789363471204,"field":"exploit_available","old":"true","new":"false"},{"seq":185714,"id":"CVE-2026-86206","ts":1789361229105,"field":"exploit_available","old":"false","new":"true"},{"seq":184501,"id":"CVE-2026-86206","ts":1789358363664,"field":"exploit_available","old":"true","new":"false"},{"seq":182752,"id":"CVE-2026-86206","ts":1789354317125,"field":"exploit_available","old":"false","new":"true"},{"seq":181545,"id":"CVE-2026-86206","ts":1789353317622,"field":"exploit_available","old":"true","new":"false"},{"seq":180338,"id":"CVE-2026-86206","ts":1789350284685,"field":"exploit_available","old":"false","new":"true"},{"seq":179131,"id":"CVE-2026-86206","ts":1789348292804,"field":"exploit_available","old":"true","new":"false"},{"seq":177924,"id":"CVE-2026-86206","ts":1789346369990,"field":"exploit_available","old":"false","new":"true"},{"seq":176717,"id":"CVE-2026-86206","ts":1789343184447,"field":"exploit_available","old":"true","new":"false"},{"seq":174834,"id":"CVE-2026-86206","ts":1789334875669,"field":"exploit_available","old":"false","new":"true"},{"seq":173629,"id":"CVE-2026-86206","ts":1789333687072,"field":"exploit_available","old":"true","new":"false"},{"seq":172443,"id":"CVE-2026-86206","ts":1789331092987,"field":"exploit_available","old":"false","new":"true"},{"seq":171257,"id":"CVE-2026-86206","ts":1789328780818,"field":"exploit_available","old":"true","new":"false"},{"seq":170052,"id":"CVE-2026-86206","ts":1789327197133,"field":"exploit_available","old":"false","new":"true"},{"seq":168847,"id":"CVE-2026-86206","ts":1789323840007,"field":"exploit_available","old":"true","new":"false"},{"seq":167642,"id":"CVE-2026-86206","ts":1789319702535,"field":"exploit_available","old":"false","new":"true"},{"seq":166437,"id":"CVE-2026-86206","ts":1789318776063,"field":"exploit_available","old":"true","new":"false"},{"seq":165232,"id":"CVE-2026-86206","ts":1789315790221,"field":"exploit_available","old":"false","new":"true"},{"seq":164027,"id":"CVE-2026-86206","ts":1789313634204,"field":"exploit_available","old":"true","new":"false"},{"seq":162822,"id":"CVE-2026-86206","ts":1789311903414,"field":"exploit_available","old":"false","new":"true"},{"seq":161617,"id":"CVE-2026-86206","ts":1789308733137,"field":"exploit_available","old":"true","new":"false"},{"seq":159730,"id":"CVE-2026-86206","ts":1789300470538,"field":"exploit_available","old":"false","new":"true"},{"seq":156719,"id":"CVE-2026-86206","ts":1789294755587,"field":"exploit_available","old":"true","new":"false"},{"seq":155514,"id":"CVE-2026-86206","ts":1789292967911,"field":"exploit_available","old":"false","new":"true"},{"seq":154309,"id":"CVE-2026-86206","ts":1789289797524,"field":"exploit_available","old":"true","new":"false"},{"seq":151560,"id":"CVE-2026-86206","ts":1789277629838,"field":"exploit_available","old":"false","new":"true"},{"seq":150521,"id":"CVE-2026-86206","ts":1789276245567,"field":"exploit_available","old":"true","new":"false"},{"seq":149488,"id":"CVE-2026-86206","ts":1789273824678,"field":"exploit_available","old":"false","new":"true"},{"seq":148455,"id":"CVE-2026-86206","ts":1789271348677,"field":"exploit_available","old":"true","new":"false"},{"seq":146486,"id":"CVE-2026-86206","ts":1789269398004,"field":"exploit_available","old":"false","new":"true"},{"seq":145291,"id":"CVE-2026-86206","ts":1789266339514,"field":"exploit_available","old":"true","new":"false"},{"seq":144195,"id":"CVE-2026-86206","ts":1789262616719,"field":"exploit_available","old":"false","new":"true"},{"seq":143099,"id":"CVE-2026-86206","ts":1789261533368,"field":"exploit_available","old":"true","new":"false"},{"seq":141930,"id":"CVE-2026-86206","ts":1789258831748,"field":"exploit_available","old":"false","new":"true"},{"seq":140771,"id":"CVE-2026-86206","ts":1789256727083,"field":"exploit_available","old":"true","new":"false"},{"seq":139573,"id":"CVE-2026-86206","ts":1789254832039,"field":"exploit_available","old":"false","new":"true"},{"seq":138375,"id":"CVE-2026-86206","ts":1789251934159,"field":"exploit_available","old":"true","new":"false"},{"seq":137177,"id":"CVE-2026-86206","ts":1789247832763,"field":"exploit_available","old":"false","new":"true"},{"seq":135979,"id":"CVE-2026-86206","ts":1789247055954,"field":"exploit_available","old":"true","new":"false"}]}