CVE-2026-86207: CWE-305 Authentication bypass by primary weakness in N-able N-central

This vulnerability (CVE-2026-86207) affects N-able N-central versions >=0 and <2026.3.1.13. It is caused by an authentication bypass in internal-only APIs, stemming from a primary weakness identified as CWE-305 (Authentication Bypass by Primary Weakness). The CVSS 4.0 base score is 7.7, indicating high severity, with network attack vector, low attack complexity, and partial privileges required. The vulnerability does not require user interaction and impacts confidentiality, integrity, and availability highly.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to bypass authentication controls on internal APIs, potentially leading to unauthorized access to sensitive functions or data within N-central. This could compromise the confidentiality, integrity, and availability of the system components accessible via these APIs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Users should monitor N-able's official advisories for updates and apply any forthcoming patches promptly.