N-able N-central CVE-2026-86206

The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) indicates no special conditions - remote unauthenticated exploitation is possible against any N-central instance where the management interface is network-reachable. No non-default feature configuration or authenticated session is required. The primary limiting factor is network accessibility: N-central deployments that expose the management interface only on internal networks or behind a VPN substantially reduce exposure. The specific internal APIs accessible through the bypass and the sensitivity of data they return are not enumerated in the available advisory.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) establishes network-reachable, unauthenticated exploitation with low confidentiality impact and no integrity or availability effects, yielding a score of 6.9. The limited blast radius is appropriate for an information-disclosure-only finding, but context matters for RMM platforms: N-central sits at the center of MSP-managed environments, and even partial API data exposure could reveal configuration details about managed endpoints, authentication tokens, or organizational topology - data that could enable follow-on attacks against downstream managed customers. No EPSS score, CISA KEV listing, or POC exploit is present in the input data, so exploitation status is assessed as no public exploit identified at time of analysis. The critical unknown is the specific data surfaced by the exposed internal APIs - the vendor advisory does not enumerate which endpoints are reachable or what they return, limiting confidence in the VC:L ceiling assessment.

An unauthenticated attacker with network access to the N-central management interface sends an HTTP request crafted to bypass the internal API access control filter - exploiting the CWE-791 incomplete filtering flaw - and receives a response from an internal API endpoint that should be restricted. The attacker collects any configuration, operational, or environmental data returned by that endpoint. No public exploit code has been identified, but filter-bypass techniques against web APIs are broadly understood and low-complexity to attempt manually.