Patchfirst
Patchfirst
CVE-2026-86206 Public exploit Medium · 6.9 EPSS 1.1%

Access control filter bypass allows unauthorised access to APIs

N-able · N-central

Official description · CVE.org

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4

Breakdown
70.1 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 5 days after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidence+5 days

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 7 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

release-notes 1

documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm

vendor-advisory 1

me.n-able.com/s/security-advisory/aArVy0000002LTNKA2/cve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apis
↑ ↓ chooseEnter openEsc close