CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

1. Executive summary

Rapid7 has disclosed two new vulnerabilities in N-able N-central — CVE-2026-86206 (CVSS 6.9 MEDIUM, CWE-791, not in CISA KEV, EPSS 0%) and CVE-2026-86207 (CVSS 7.7 HIGH, CWE-305, not in CISA KEV, EPSS 0%) — which, when chained, allow a remote unauthenticated attacker to bypass authentication and create an attacker-controlled System administrator account on an affected server. All on-premise N-central versions prior to 2026.3.1.13 (2026.3 Hotfix 3) are vulnerable; the vendor has patched both flaws and hosted environments have been updated automatically. Neither CVE is currently listed in CISA KEV and EPSS scores are 0%, but the disclosure lands in the immediate aftermath of active in-the-wild exploitation of two closely related N-central authentication bypasses (CVE-2026-18556 and CVE-2026-18577, both KEV-listed), meaning adversary attention on this attack surface is demonstrably high. For EMEA financial services clients running on-premise N-central — directly or via an MSP — an RMM server compromise provides an efficient path to administrative control of downstream managed estates and must be treated as urgent.

2. Regulatory framing

No other article in the regulatory reference is specifically engaged by the facts of this item.

3. Technical analysis & attack chain

Vulnerability mechanism. N-central exposes its management interface (TCP 8443 by default) through Envoy, an edge proxy, which forwards accepted requests to Jetty, the Java web server hosting the application. The application grants requests originating from loopback (127.0.0.1) more access than remote requests. The entire access-control design depends on Envoy, Jetty, and N-central's access filter agreeing on (a) which path the client requested and (b) whether the client is local. The exploit makes them disagree about both.

Confirmed attack chain (CVE-2026-86206 chained with CVE-2026-86207)

1. Semicolon bypasses Envoy path filtering (CVE-2026-86206). Envoy rules (from the n-central-proxy-4.5.6-5 package, defined in /etc/opt/envoy/lds_intermediate.yaml) return HTTP 403 for paths beginning with /dms/services or /internal/dms on the management listener, with a catch-all routing everything else to the DMS cluster. The attacker sends POST /dms;/services/ServerUI. Because the character after /dms is a semicolon, the path does not match the blocked prefixes, so Envoy forwards it to Jetty.
2. Jetty normalises the path back to the protected servlet. The shipped jetty-http-9.4.56.v20240826.jar (org.eclipse.jetty.http.HttpURI and org.eclipse.jetty.util.URIUtil) treats semicolon-prefixed text as a path parameter and strips it when producing the decoded servlet-dispatch path. Jetty therefore decodes /dms;/services/ServerUI to /dms/services/ServerUI, which matches the Axis SOAP servlet mapping (DMSServlet, org.apache.axis.transport.http.AxisServlet) in /opt/nable/webapps/ROOT/WEB-INF/web.xml. The same technique works against the CXF SOAP servlet via /internal;/dms/services2/ServerUI2, decoded to /internal/dms/services2/ServerUI2. A single semicolon is sufficient.
3. Crafted Forwarded header defeats the loopback check. The request carries Forwarded: for="127.0.0.\1". Under HTTP quoted-string grammar the backslash escapes the next character: Jetty's ForwardedRequestCustomizer (in jetty-server-9.4.56.v20240826.jar) strips the backslash and exposes 127.0.0.1 as the request's remote address. N-central then re-parses the original header in com.nable.util.LocalHostUtils (from /opt/nable/webapps/ROOT/WEB-INF/lib/dmsservice-11.0.1-SNAPSHOT.jar), which removes the quotes but not the backslash, yielding the invalid string 127.0.0.\1.
4. Fail-open validation. LocalHostUtils.xffCheck() rejects only Forwarded values it successfully recognises as loopback; isLoopbackAddress("127.0.0.\1") returns false because the value is invalid, so the loop continues and xffCheck() returns true — an invalid Forwarded value causes the check to fail open. In com.nable.server.ServletPathFilter.isAllowedRequest(), the xffCheck passes, and isLocalhost() succeeds because Jetty has already normalised the remote address to 127.0.0.1. The filter returns true without consulting the remote-path allowlist. Both discrepancies are required: the semicolon alone leaves the client's real remote address intact (ServletPathFilter denies), and the header alone is stopped by Envoy's HTTP 403.
5. Pre-login session obtained. Reaching /dms/services/ServerUI lets the attacker invoke the Session.Hello SOAP operation (Rapid7 references prior work by Horizon3 on the legacy SOAP API) to obtain a SessionID. This is a pre-login session only — it proves the access-control bypass worked but does not identify an authenticated user.
6. Legacy 2FA bypass converts the session to privileged (CVE-2026-86207). com.nable.server.ui.UserTwoFactorLogin.twoFactorLogin(int sessionID, int userID, String password) binds the requested user ID to the session before attempting legacy two-factor authentication. A normal authentication rejection removes the binding (makeSessionInvalid), but if an exception is thrown the binding is left in place. N-central supports two second-factor systems: legacy profile-based authentication against an external AuthAnvil or RSA SecurID server, and native TOTP "Two-Step Verification". UserTwoFactorLogin implements only the former and does not enforce the user's native TOTP setting. In a default installation, legacy 2FA processing raises an exception for builtin identities that lack a legacy AuthAnvil/RSA profile association. The exploitable builtin identities, by well-known ID: User ID 1 (N-able Administrator), User ID 50 (Product Administrator), User ID 51 (N-able Support).
7. Privileged session and account creation. A SOAP call to User.TwoFactorLogin with a dummy password for any of the above IDs converts the pre-login session into a privileged SOAP session for that user. Additional calls to the ServerUI2 SOAP endpoint then create a new attacker-controlled System user account — full administrative control of the N-central server, and through it, the managed estate.

Context and confidence caveats. This chain is a pre-authentication, network-reachable, unauthenticated-to-System-administrator path — the same impact class as CVE-2026-18556 and CVE-2026-18577, which were both exploited in the wild (per N-able and CISA KEV) and led to attackers using the platform's Take Control functionality and deploying Cloudflare Tunnel (cloudflared) for persistence. No exploitation of CVE-2026-86206/86207 has been reported as of publication, and neither is KEV-listed — but the technical detail is fully disclosed, the predecessor flaws were weaponised within days of disclosure, and the entire chain is single-sourced to Rapid7's research (discovered by Stephen Fewer, Senior Principal Security Researcher). Treat the exploitability assessment as high-confidence but the absence of exploitation as a point-in-time statement only.

4. Mitigation & containment

P1 — within 24 hours

• Patch. Upgrade on-premise N-central to 2026.3 Hotfix 3 (version 2026.3.1.13). All prior versions are vulnerable. The vendor and Rapid7 both direct customers to apply this outside normal patching cycles. Hosted N-central environments require no action — the vendor has applied the updates.
• Verify MSP exposure. Clients using an MSP that operates N-central on their behalf must obtain confirmation the instance is at 2026.3.1.13. Given the demonstrated in-the-wild exploitation of the predecessor flaws, an unpatched MSP-operated RMM is a direct path into the client estate.
• Confirm exposure. Rapid7 states authenticated vulnerability checks for both CVEs are available in the September 8 content release for Exposure Command, InsightVM, and Nexpose customers. Run authenticated scans against all N-central servers.

P2 — within 72 hours

• Review for compromise. Because the chain ends in new System-user creation, audit N-central for: newly created or modified administrator accounts (particularly any account created since early August 2026), authentication logs, User.TwoFactorLogin audit entries (the code writes "TWO FACTOR LOGIN SUCCESSFUL"/"TWO FACTOR LOGIN FAILED" audit entries on session ID and user ID — grep for unexpected successes against user IDs 1, 50, 51), and Take Control session activity. The vendor's guidance for the predecessor CVE-2026-18577 — reviewing Windows service installation events and remote management logs — remains the relevant playbook if compromise is suspected.
• Restrict exposure. If patching is delayed for any reason, ensure the N-central management interface (TCP 8443) is not reachable from the internet; place it behind VPN/allow-listed access. Note this is risk reduction, not remediation — the chain is unauthenticated and requires only network reachability to the management port.
• Check for the predecessor flaws. Confirm the environment is also clear of CVE-2026-18556 and CVE-2026-18577 (fixed in 2026.3.1 Hotfix 1, version 2026.3.1.7); 2026.3.1.13 supersedes both fixes, but any instance that was exposed during August 2026 warrants the compromise review above.

P3 — within 7 days

• Upgrade N-central agents after applying the server hotfix (vendor recommendation carried over from the CVE-2026-18577 guidance).
• Hunt historical web logs for the bypass signature: requests to paths matching /dms;/ or /internal;/ (semicolon-embedded), and Forwarded headers containing a quoted-pair backslash (e.g. for="127.0.0.\1"), against the management listener.
• Update third-party risk records for MSP relationships to reflect this patch cycle and the vendor's out-of-cycle release practice.

5. Indicators of compromise

No indicators of compromise are available in the source material for CVE-2026-86206/CVE-2026-86207 (no exploitation has been reported and no attacker artefacts are associated with these CVEs).

Behavioural indicators (derived from the disclosed exploit chain and the predecessor-campaign guidance; hunt-focused, not proof of compromise on their own):

6. Detection

The disclosed exploit chain provides distinctive request-level artefacts (exact paths, header value, SOAP operation names, audit strings) suitable for web-log detection.

rule NABLE_NCENTRAL_AUTH_BYPASS_CVE_2026_8620X
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-08"
        reference = "https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed"
        description = "Detects N-central auth-bypass exploit request artefacts: semicolon path bypass, crafted Forwarded quoted-pair header, and legacy 2FA SOAP operation"
    strings:
        $path1 = "/dms;/services/ServerUI" ascii
        $path2 = "/internal;/dms/services2/ServerUI2" ascii
        $fwd = "Forwarded: for=\"127.0.0.\\1\"" ascii
        $soap1 = "User.TwoFactorLogin" ascii
        $soap2 = "Session.Hello" ascii
        $audit = "TWO FACTOR LOGIN SUCCESSFUL" ascii
    condition:
        2 of them
}

Note: this rule is intended for scanning captured HTTP request bodies, full-request network captures, or extracted log lines containing the raw request — not for binary file scanning.

title: N-central authentication bypass - semicolon path and crafted Forwarded header
id: 8f3a2c1e-7b4d-4e56-9a8f-1c2d3e4f5a6b
status: experimental
description: Detects POST requests to N-central management interface using semicolon-embedded paths and a Forwarded header with a quoted-pair backslash, matching the CVE-2026-86206/86207 exploit chain.
references:

    - https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed
author: Adverse Trace
date: 2026/09/08
logsource:
    category: webserver
    product: n_central
detection:
    selection_path:
        cs-method: 'POST'
        cs-uri-query|startswith:

            - '/dms;/'
            - '/internal;/'
    selection_fwd:
        cs-header-Forwarded|contains: '127.0.0.\1'
    condition: 1 of selection_*
falsepositives:

    - Legitimate clients sending semicolon path parameters to the N-central UI port are not expected; treat all hits as suspicious
level: high

CVE assessment

2 referenced CVEs

7. Sources

• Rapid7 — CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED) — https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed — 2026-09-08
• Rapid7 — CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild — https://www.rapid7.com/blog/post/etr-cve-2026-18577-n-able-n-central-authentication-bypass-exploited-in-the-wild — 2026-08-04
• CISA KEV (via NVD) — CVE-2026-18556, N-able N-central Authentication Bypass Using an Alternate Path or Channel — https://nvd.nist.gov/vuln/detail/CVE-2026-18556 — KEV due date 2026-08-07
• CISA KEV (via NVD) — CVE-2026-18577, N-able N-central Authentication Bypass Using an Alternate Path or Channel — https://nvd.nist.gov/vuln/detail/CVE-2026-18577 — KEV due date 2026-08-06
• GitHub Security Advisory GHSA-qgcm-97x5-6q8q — An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central — https://github.com/advisories/GHSA-qgcm-97x5-6q8q
• Dark Reading — Attackers Exploit N-able Patch Bypass Flaw on RMM Servers — https://www.darkreading.com/vulnerabilities-threats/attackers-exploit-n-able-patch-bypass-flaw
• The Hacker News — N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete — https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html

8. Adverse Trace position

The verified severity ratings for these CVEs individually (6.9 MEDIUM and 7.7 HIGH, neither KEV-listed, EPSS 0%) understate the practical risk: chained, they form an unauthenticated, remote, network-reachable path to full System administrator control of an RMM server, and the identical impact class in the same product (CVE-2026-18556/18577) was exploited in the wild within days of disclosure. We assess the exploitation likelihood for this pair as elevated despite the current 0% EPSS, because full technical details and a working exploit script were provided to the vendor on August 28 and the disclosure is now public. EMEA financial services clients with on-premise N-central — their own or via an MSP — should treat patching to 2026.3.1.13 as immediate, and should run the compromise review in §4 P2 regardless, since any instance exposed during August 2026 overlaps the active predecessor campaign. The technical analysis is single-sourced to Rapid7; we will monitor for independent confirmation, KEV listing, or first exploitation reports and will reissue this advisory if the exploitation picture changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.