CVE-2026-86206
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
Early warning: exploitation observed
- Exploitation observed since Sep 10, 2026
- Not yet in the official CISA catalogue
- First attack observed 4 days after disclosure
Source: VulnCheck KEV · Sep 10, 2026
Weakness type (CWE)CWE-791
Related articles
Actively Exploited N-able N-central Flaw Enables Pre-Authentication Remote Code Execution
CISA warns CVE-2026-86218 in N-able N-central is actively exploited, enabling pre-auth RCE. Update to 2026.3 Hotfix 4 immediately.
N-able Fixes Critical Pre-Auth RCE in N-central as Exploitation Reports Conflict
N-able fixes CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-central. Update to 2026.3.1.14 immediately amid conflicting exploitation reports.
This product uses the NVD API but is not endorsed or certified by the NVD.