{"vulnerability": "CVE-2026-86207", "sightings": [{"uuid": "97b7b439-922a-4f2e-a0fd-eb41db0b96f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86207", "type": "seen", "source": "https://bsky.app/profile/stephenfewer.bsky.social/post/3muyymguz422s", "content": "While researching last months N-able N-central exploit (CVE-2026-18577, on KEV), we found and reported a new authentication bypass chain (CVE-2026-86206 and CVE-2026-86207). Patched and disclosed by the vendor over the weekend, full details on the @rapid7.com blog: www.rapid7.com/blog/post/ve...", "creation_timestamp": "2026-09-08T12:12:11.273864Z"}, {"uuid": "09b61aff-9ef9-41bb-9c64-fedf54786c0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86207", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117236471187412679", "content": "New.\nRapid7: CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED) https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/ @Rapid7Official #infosec #vulnerability #threatresearch", "creation_timestamp": "2026-09-08T16:56:24.792311Z"}, {"uuid": "01cec363-03f2-4104-b15d-2c48b5bc927f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86207", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-86207.yaml", "content": "", "creation_timestamp": "2026-09-09T00:00:04.651162Z"}, {"uuid": "2fd8521f-0316-470e-9e61-288ebd4eead8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-86207", "type": "seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117238521729646565", "content": "N-able didn't beat around the bush:\n\nSince our post 9/5/2026, 08:11:00 UTC a third independent researcher disclosed to N-able a new vulnerability\u2014 one that has been exploited in the wild and is unrelated to the previously disclosed CVEs.\nThis critical zero-day vulnerability, CVE-2026-86218, could allow pre-authenticated access to the N-central server if exploited.\n\nhttps://www.n-able.com/blog/n-central-security-hotfix-september-5-2026\nhttps://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/\nhttps://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog\n#nable #zeroday #KEV #CVE", "creation_timestamp": "2026-09-09T01:41:29.685918Z"}, {"uuid": "1e3d51de-3da6-4fca-9a97-a11cdadc1e95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86207", "type": "seen", "source": "https://t.me/HackerNewscyber/3417", "content": "\u2708 \u0627\u0646\u062a\u0634\u0627\u0631 \u0648\u0635\u0644\u0647 \u0627\u0636\u0637\u0631\u0627\u0631\u06cc \u0628\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc N-central\n\n\u00a9\ufe0f \u0634\u0631\u06a9\u062a \u00ab\u0627\u0650\u0646\u200c\u0627\u06cc\u0628\u0644\u00bb (N-able) \u06cc\u06a9 \u0648\u0635\u0644\u0647 \u0627\u0636\u0637\u0631\u0627\u0631\u06cc \u0628\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-86218 \u062f\u0631 \u067e\u0644\u062a\u0641\u0631\u0645 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0648 \u0646\u0638\u0627\u0631\u062a \u00ab\u0627\u0650\u0646\u200c\u0633\u0646\u062a\u0631\u0627\u0644\u00bb \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f.\n\n\u00a9\ufe0f \u0627\u06cc\u0646 \u0646\u0642\u0635 \u0628\u0627 \u0628\u0627\u0644\u0627\u062a\u0631\u06cc\u0646 \u0633\u0637\u062d \u0634\u062f\u062a\u060c \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0628\u062f\u0648\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0648\u06cc\u0698\u0647 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u0627 \u062d\u0645\u0644\u0627\u062a \u06a9\u0645\u200c\u067e\u06cc\u0686\u06cc\u062f\u06af\u06cc \u0631\u0648\u06cc \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a\u060c \u06a9\u062f \u0645\u062e\u0631\u0628 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f. \u062d\u062f\u0648\u062f \u06f1\u06f5\u06f0\u06f0 \u0633\u0631\u0648\u0631 N-central \u062f\u0631 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.\n\n\u00a9\ufe0f \u0634\u0631\u06a9\u062a \u00ab\u0647\u0627\u0646\u062a\u0631\u0633\u00bb (Huntress) \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u062f\u0631 \u06a9\u0646\u0627\u0631 \u062f\u0648 \u0646\u0642\u0635 \u062f\u06cc\u06af\u0631\u060c CVE-2026-86206 \u0648 CVE-2026-86207\u060c \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u062d\u062a\u0645\u0627\u0644\u06cc \u0631\u0648\u0632\u0635\u0641\u0631 \u062f\u0627\u0646\u0633\u062a\u0647 \u0627\u0633\u062a. \u0627\u0650\u0646\u200c\u0627\u06cc\u0628\u0644 \u062a\u0627\u06a9\u0646\u0648\u0646 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 CVE-2026-86218 \u0631\u0627 \u062a\u0623\u06cc\u06cc\u062f \u0646\u06a9\u0631\u062f\u0647\u060c \u0627\u0645\u0627 \u0627\u0632 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u062f\u0627\u062e\u0644\u06cc \u062e\u0648\u0627\u0633\u062a\u0647 \u0627\u0633\u062a \u0641\u0648\u0631\u0627\u064b \u0628\u0647 N-central 2026.3 HF4 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u0646\u062f.\n\n\ud83c\udf10 @HackerNewsCyber", "creation_timestamp": "2026-09-09T03:00:06.126352Z"}, {"uuid": "5a15a3e1-44ec-46ba-a78c-144dda324ff0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86207", "type": "seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mv3eav7br52d", "content": "Original text: \"CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)\" \u2014 Stephen Fewer, Rapid7 (September 8, 2026). Code, tables and figures below are reproduced verbatim with attribution\nhttps://core-jmp.org/2026/09/nable-ncentral-authentication-bypass-cve-2026-86206-86207/", "creation_timestamp": "2026-09-09T10:45:46.785875Z"}, {"uuid": "2bbe7c8e-3c07-4dac-b9d4-fd2141e9178a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86207", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885", "content": "", "creation_timestamp": "2026-09-09T20:15:02.784979Z"}, {"uuid": "3ad37968-e555-4f61-9ab7-3e16e728d823", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86207", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mv3qoeicrl2g", "content": "CVE-2026-86206, CVE-2026-86207: N-able N\n\n", "creation_timestamp": "2026-09-09T14:28:03.240382Z"}, {"uuid": "ae92011e-d876-4a9d-86d7-ed4c43c24137", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86207", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-86207.yaml", "content": "", "creation_timestamp": "2026-09-10T00:00:08.824208Z"}, {"uuid": "dcba113c-e087-46b7-b89f-0ca5331e583c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86207", "type": "seen", "source": "https://t.me/HackerNewscyber/3417", "content": "\u2708 \u0627\u0646\u062a\u0634\u0627\u0631 \u0648\u0635\u0644\u0647 \u0627\u0636\u0637\u0631\u0627\u0631\u06cc \u0628\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc N-central\n\n\u00a9\ufe0f \u0634\u0631\u06a9\u062a \u00ab\u0627\u0650\u0646\u200c\u0627\u06cc\u0628\u0644\u00bb (N-able) \u06cc\u06a9 \u0648\u0635\u0644\u0647 \u0627\u0636\u0637\u0631\u0627\u0631\u06cc \u0628\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-86218 \u062f\u0631 \u067e\u0644\u062a\u0641\u0631\u0645 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0648 \u0646\u0638\u0627\u0631\u062a \u00ab\u0627\u0650\u0646\u200c\u0633\u0646\u062a\u0631\u0627\u0644\u00bb \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f.\n\n\u00a9\ufe0f \u0627\u06cc\u0646 \u0646\u0642\u0635 \u0628\u0627 \u0628\u0627\u0644\u0627\u062a\u0631\u06cc\u0646 \u0633\u0637\u062d \u0634\u062f\u062a\u060c \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0628\u062f\u0648\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0648\u06cc\u0698\u0647 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u0627 \u062d\u0645\u0644\u0627\u062a \u06a9\u0645\u200c\u067e\u06cc\u0686\u06cc\u062f\u06af\u06cc \u0631\u0648\u06cc \u0633\u0627\u0645\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a\u060c \u06a9\u062f \u0645\u062e\u0631\u0628 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f. \u062d\u062f\u0648\u062f \u06f1\u06f5\u06f0\u06f0 \u0633\u0631\u0648\u0631 N-central \u062f\u0631 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f.\n\n\u00a9\ufe0f \u0634\u0631\u06a9\u062a \u00ab\u0647\u0627\u0646\u062a\u0631\u0633\u00bb (Huntress) \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u062f\u0631 \u06a9\u0646\u0627\u0631 \u062f\u0648 \u0646\u0642\u0635 \u062f\u06cc\u06af\u0631\u060c CVE-2026-86206 \u0648 CVE-2026-86207\u060c \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u062d\u062a\u0645\u0627\u0644\u06cc \u0631\u0648\u0632\u0635\u0641\u0631 \u062f\u0627\u0646\u0633\u062a\u0647 \u0627\u0633\u062a. \u0627\u0650\u0646\u200c\u0627\u06cc\u0628\u0644 \u062a\u0627\u06a9\u0646\u0648\u0646 \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0627\u0632 CVE-2026-86218 \u0631\u0627 \u062a\u0623\u06cc\u06cc\u062f \u0646\u06a9\u0631\u062f\u0647\u060c \u0627\u0645\u0627 \u0627\u0632 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u062f\u0627\u062e\u0644\u06cc \u062e\u0648\u0627\u0633\u062a\u0647 \u0627\u0633\u062a \u0641\u0648\u0631\u0627\u064b \u0628\u0647 N-central 2026.3 HF4 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u0646\u062f.\n\n\ud83c\udf10 @HackerNewsCyber", "creation_timestamp": "2026-09-10T00:00:54.874399Z"}, {"uuid": "c6d5594a-a810-46f7-acb0-e4bfa770801a", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86207", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d7a8bc6e-5be5-42b0-8c11-40aa62eb3960", "content": "", "creation_timestamp": "2026-09-10T08:00:31.488334Z"}]}