CVE-2026-86206: CWE-791 Incomplete filtering of special elements in N-able N-central

This vulnerability (CVE-2026-86206) in N-able N-central arises from incomplete filtering in the internal API access control filter, which permits unauthorized users to access internal APIs. The weakness is categorized under CWE-791 (Improper Restriction of Special Elements in Input). The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and low impact on confidentiality. The vulnerability affects all versions from initial releases up to but not including 2026.3.1.13. The vendor has fixed this issue in N-central versions 2026.3 HF3 and 2026.4.

Exploitation of this vulnerability allows an attacker to bypass internal API access controls, potentially leading to unauthorized access to sensitive internal functions or data within N-central. The impact on confidentiality is low, and there is no impact on integrity or availability as per the CVSS vector. No known exploits are reported in the wild.

A fix is available and should be applied by upgrading N-central to version 2026.3 HF3 or later, including 2026.4. Users should prioritize updating to these versions to remediate the vulnerability.