CVE-2026-86206

MediumCVSS 6.9/10Last modified Sep 8, 2026

Description

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-791

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
N-able	N-central	< 2026.3.1.13

References

Timeline

Published: Sep 5, 2026
Last modified: Sep 8, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-862077.7An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs CVE-2026-862087.3A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /d CVE-2026-862097.3A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete_CVE-2026-86218.8Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers to impersonate other own CVE-2026-862107.3A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unk CVE-2026-862117.3A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the compone CVE-2026-862124.3A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation le CVE-2026-862137.3A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/universi CVE-2026-862147.3A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This CVE-2026-862154.3A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/serv CVE-2026-862164.3A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of th CVE-2026-862175.3A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hote