CVE-2026-125878
HighCVSS 8.7Summary
N-able N-central contains a cross-site scripting vulnerability caused by improper neutralization of input during web page generation, allowing resource injection. This issue affects N-central versions before 26.4.1.
Risk Assessment
An attacker could inject malicious content into pages displayed to users, potentially leading to script execution and session data theft. This impacts the confidentiality and integrity of the application.
Recommendation
Update N-able N-central to version 26.4.1 or later. Apply input validation and encoding in the application.
Other vulnerabilities in N-able N-central
See all- CVE-2026-91000High
A missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central before 2026.4.1.
- CVE-2026-125958High
A download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central through 24.6.1.
- CVE-2026-125882High
N-able N-central contains a relative path traversal vulnerability that allows an attacker to manipulate file access paths. This issue affects N-central versions before 26.4.1.
- CVE-2026-125880High
N-able N-central contains a Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of HTTP headers for scripting syntax. This issue affects N-central versions before 26.4.1.
- CVE-2026-125879High
N-able N-central contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects N-central versions before 26.4.1.
- CVE-2026-125883Critical
N-able N-central before version 26.4.1 is vulnerable to improper restriction of XML external entity references, allowing XML Schema Poisoning. The issue affects versions prior to 26.4.1.
- CVE-2026-125881Critical
N-able N-central before version 26.4.1 contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to force server-side requests. The issue affects versions prior to 26.4.1.
- CVE-2026-18556HighActively exploited
Authentication bypass using an alternate path or channel vulnerability in N-able N-central through version 2026.1 allows authentication bypass.
- CVE-2025-8876HighActively exploited
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection. This issue affects N-central before 2025.3.1.
- CVE-2025-8875HighActively exploited
Deserialization of untrusted data vulnerability in N-able N-central allows local code execution. Affects versions before 2025.3.1.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection. This issue affects N-central: before 26.4.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS