CVE-2026-86207
An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs
Early warning: exploitation observed
- Exploitation observed since Sep 9, 2026
- Not yet in the official CISA catalogue
- First attack observed 3 days after disclosure
Source: VulnCheck KEV · Sep 9, 2026
Weakness type (CWE)CWE-305
Related articles
Actively Exploited N-able N-central Flaw Enables Pre-Authentication Remote Code Execution
CISA warns CVE-2026-86218 in N-able N-central is actively exploited, enabling pre-auth RCE. Update to 2026.3 Hotfix 4 immediately.
N-able Fixes Critical Pre-Auth RCE in N-central as Exploitation Reports Conflict
N-able fixes CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-central. Update to 2026.3.1.14 immediately amid conflicting exploitation reports.
This product uses the NVD API but is not endorsed or certified by the NVD.