N-able didn't beat around the bush: Since our post 9/5/2026, 08:11:00 UTC a third independent researcher disclosed to N-able a new vulnerabi

Rapid7 Labs, working from the recent CVE-2026-18577 authentication bypass in N-central, found two additional chained flaws that give a remote unauthenticated attacker full System administrator control. CVE-2026-86206 (CWE-791, CVSS 6.9) is a semicolon-forwarded access-control bypass in Envoy, the edge proxy that feeds Jetty on TCP 8443; it treats loopback requests (127.0.0.1) with greater privilege than remote ones. CVE-2026-86207 (CWE-305, CVSS 7.7) is the UserTwoFactorLogin authentication bypass that completes the chain. The vendor patched both in N-central 2026.3 Hotfix 3, but the sequence demonstrates that N-central's authorization model treats network origin as a security boundary, which collapses as soon as the proxy layer can be coerced into forwarding attacker-controlled traffic. Stephen Fewer, Senior Principal Security Researcher at Rapid7, disclosed the pair according to Rapid7's disclosure policy.

The chain is not a theoretical pairing. Once chained, it creates a new attacker-controlled System administrator account on the RMM server, which means every managed endpoint, script push, agent tool, and Take Control session falls under adversary control. This is the third independent disclosure to N-able since the September 5 post, and it lands after an incomplete Hotfix 3; the digest records that Huntress traced a customer compromise on September 4 to an instance that was already fully patched, confirming active exploitation. With scanning reported from 23.234.64.0/18 and 55.6 percent of reachable cloud servers still unpatched, an exposed N-central server is not a single-system event but a gateway into every MSP customer network it manages. That is why this chain matters more than another medium-high CVSS pair: it converts a single proxy misconfiguration into full administrative control of an enterprise RMM platform used by managed service providers.

Upgrade immediately to N-central 2026.3 Hotfix 3 for CVE-2026-86206 and CVE-2026-86207, then move to 2026.3.1.14 (Hotfix 4, released September 6) which closes CVE-2026-86218, the CVSS 10.0 pre-authentication RCE actively exploited in the wild. Restrict the management interface on TCP 8443 to trusted sources only, and audit for rogue System administrator accounts created since September 4. Hunt for suspicious IIS worker activity, unexpected outbound connections from the N-central server, and unusual agent script pushes. Treat any server unpatched since September 5 as potentially compromised, because the rapid succession of disclosures and incomplete fixes suggests active adversary awareness of the authorization boundary failure.

Watch for confirmation that Hotfix 4 fully addresses the pre-auth RCE (CVE-2026-86218) without leaving residual bypass paths, and monitor whether N-able issues a Hotfix 5 or revises the authorization model around Envoy's loopback handling. If Huntress or Shadowserver publish new exposure metrics or additional compromise traces tied to this chain, the assessment must shift from defensive upgrade to incident response.