{"id":"CVE-2026-86207","title":"An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs","summary":"An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs","severity":"high","cvss":7.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-305"],"vendor":"N-able","product":"N-central","affected":["N-central < 2026.3.1.13"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:16:41.410","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86207","references":[{"url":"https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm","label":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"},{"url":"https://me.n-able.com/s/security-advisory/aArVy0000002LUzKAM/cve202686207-authentication-bypass-leads-to-unauthorised-access-to-ncentral","label":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00734,"epssPercentile":0.52512,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-08T15:18:35.492307Z"},"cvssSource":"cna","ingestedAt":"2026-09-06T10:53:52.293Z","exploits":{"nuclei":["CVE-2026-86207"],"checkedAt":"2026-09-21T15:31:02.117Z"},"exploitAvailable":true,"slug":"CVE-2026-86207","body":"## Overview\n\nAn authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":202086,"id":"CVE-2026-86207","ts":1789400048441,"field":"exploit_available","old":"false","new":"true"},{"seq":200813,"id":"CVE-2026-86207","ts":1789397616349,"field":"exploit_available","old":"true","new":"false"},{"seq":199506,"id":"CVE-2026-86207","ts":1789395528885,"field":"exploit_available","old":"false","new":"true"},{"seq":198751,"id":"CVE-2026-86207","ts":1789392244047,"field":"exploit_available","old":"true","new":"false"},{"seq":197084,"id":"CVE-2026-86207","ts":1789384292385,"field":"exploit_available","old":"false","new":"true"},{"seq":194213,"id":"CVE-2026-86207","ts":1789378783015,"field":"exploit_available","old":"true","new":"false"},{"seq":193000,"id":"CVE-2026-86207","ts":1789376515063,"field":"exploit_available","old":"false","new":"true"},{"seq":191787,"id":"CVE-2026-86207","ts":1789373631044,"field":"exploit_available","old":"true","new":"false"},{"seq":190572,"id":"CVE-2026-86207","ts":1789369475528,"field":"exploit_available","old":"false","new":"true"},{"seq":189359,"id":"CVE-2026-86207","ts":1789368412992,"field":"exploit_available","old":"true","new":"false"},{"seq":188142,"id":"CVE-2026-86207","ts":1789365230750,"field":"exploit_available","old":"false","new":"true"},{"seq":186929,"id":"CVE-2026-86207","ts":1789363471211,"field":"exploit_available","old":"true","new":"false"},{"seq":185715,"id":"CVE-2026-86207","ts":1789361229112,"field":"exploit_available","old":"false","new":"true"},{"seq":184502,"id":"CVE-2026-86207","ts":1789358363672,"field":"exploit_available","old":"true","new":"false"},{"seq":182753,"id":"CVE-2026-86207","ts":1789354317132,"field":"exploit_available","old":"false","new":"true"},{"seq":181546,"id":"CVE-2026-86207","ts":1789353317629,"field":"exploit_available","old":"true","new":"false"},{"seq":180339,"id":"CVE-2026-86207","ts":1789350284691,"field":"exploit_available","old":"false","new":"true"},{"seq":179132,"id":"CVE-2026-86207","ts":1789348292810,"field":"exploit_available","old":"true","new":"false"},{"seq":177925,"id":"CVE-2026-86207","ts":1789346369996,"field":"exploit_available","old":"false","new":"true"},{"seq":176718,"id":"CVE-2026-86207","ts":1789343184456,"field":"exploit_available","old":"true","new":"false"},{"seq":174835,"id":"CVE-2026-86207","ts":1789334875675,"field":"exploit_available","old":"false","new":"true"},{"seq":173630,"id":"CVE-2026-86207","ts":1789333687087,"field":"exploit_available","old":"true","new":"false"},{"seq":172444,"id":"CVE-2026-86207","ts":1789331092994,"field":"exploit_available","old":"false","new":"true"},{"seq":171258,"id":"CVE-2026-86207","ts":1789328780825,"field":"exploit_available","old":"true","new":"false"},{"seq":170053,"id":"CVE-2026-86207","ts":1789327197140,"field":"exploit_available","old":"false","new":"true"},{"seq":168848,"id":"CVE-2026-86207","ts":1789323840015,"field":"exploit_available","old":"true","new":"false"},{"seq":167643,"id":"CVE-2026-86207","ts":1789319702543,"field":"exploit_available","old":"false","new":"true"},{"seq":166438,"id":"CVE-2026-86207","ts":1789318776070,"field":"exploit_available","old":"true","new":"false"},{"seq":165233,"id":"CVE-2026-86207","ts":1789315790234,"field":"exploit_available","old":"false","new":"true"},{"seq":164028,"id":"CVE-2026-86207","ts":1789313634211,"field":"exploit_available","old":"true","new":"false"},{"seq":162823,"id":"CVE-2026-86207","ts":1789311903421,"field":"exploit_available","old":"false","new":"true"},{"seq":161618,"id":"CVE-2026-86207","ts":1789308733144,"field":"exploit_available","old":"true","new":"false"},{"seq":159731,"id":"CVE-2026-86207","ts":1789300470544,"field":"exploit_available","old":"false","new":"true"},{"seq":156720,"id":"CVE-2026-86207","ts":1789294755594,"field":"exploit_available","old":"true","new":"false"},{"seq":155515,"id":"CVE-2026-86207","ts":1789292967917,"field":"exploit_available","old":"false","new":"true"},{"seq":154310,"id":"CVE-2026-86207","ts":1789289797531,"field":"exploit_available","old":"true","new":"false"},{"seq":151561,"id":"CVE-2026-86207","ts":1789277629844,"field":"exploit_available","old":"false","new":"true"},{"seq":150522,"id":"CVE-2026-86207","ts":1789276245574,"field":"exploit_available","old":"true","new":"false"},{"seq":149489,"id":"CVE-2026-86207","ts":1789273824685,"field":"exploit_available","old":"false","new":"true"},{"seq":148456,"id":"CVE-2026-86207","ts":1789271348685,"field":"exploit_available","old":"true","new":"false"},{"seq":146487,"id":"CVE-2026-86207","ts":1789269398011,"field":"exploit_available","old":"false","new":"true"},{"seq":145292,"id":"CVE-2026-86207","ts":1789266339528,"field":"exploit_available","old":"true","new":"false"},{"seq":144196,"id":"CVE-2026-86207","ts":1789262616726,"field":"exploit_available","old":"false","new":"true"},{"seq":143100,"id":"CVE-2026-86207","ts":1789261533375,"field":"exploit_available","old":"true","new":"false"},{"seq":141931,"id":"CVE-2026-86207","ts":1789258831755,"field":"exploit_available","old":"false","new":"true"},{"seq":140772,"id":"CVE-2026-86207","ts":1789256727090,"field":"exploit_available","old":"true","new":"false"},{"seq":139574,"id":"CVE-2026-86207","ts":1789254832045,"field":"exploit_available","old":"false","new":"true"},{"seq":138376,"id":"CVE-2026-86207","ts":1789251934166,"field":"exploit_available","old":"true","new":"false"},{"seq":137178,"id":"CVE-2026-86207","ts":1789247832769,"field":"exploit_available","old":"false","new":"true"},{"seq":135980,"id":"CVE-2026-86207","ts":1789247055962,"field":"exploit_available","old":"true","new":"false"}]}