CVE-2026-86207 – N-able N-central

CVSS 7.7 HIGH [1] Zero-Day – Immediate Deployment

“When attackers can run code on the console that manages your fleet, every endpoint becomes theirs. Patch N-central now.”

N-able has released fixes for three vulnerabilities in N-central, and attackers are actively exploiting all three: CVE-2026-86206, CVE-2026-86207 and CVE-2026-86218. The most serious, CVE-2026-86218, has a CVSS score of 10.0, Critical severity. It allows remote code execution before authentication and affects N-central versions before 2026.3.1.14. CVE-2026-86207 has a CVSS score of 7.7, High severity. It is an authentication bypass in internal-only APIs in versions before 2026.3 HF 3. CVE-2026-86206 has a CVSS score of 6.9, Medium severity. It is a flaw in the internal API access control filter that allows unauthorized access to internal APIs, and N-central 2026.3 HF3 and 2026.4 fix it.

N-central manages remote endpoints, so an attacker who takes over the console can reach every device it manages. Taken together, these flaws give attackers a direct path from no access to full control. Upgrade all N-central instances to a fixed release immediately.

Key Details

CWE Classification: CWE-305

Patch this CVE on all your endpoints in under 5 minutes. First 200 endpoints are free forever, scale as needed.