CVE-2026-125880
HighCVSS 8.3Summary
N-able N-central contains a Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of HTTP headers for scripting syntax. This issue affects N-central versions before 26.4.1.
Risk Assessment
An attacker could inject malicious scripts executed in a user's browser, potentially leading to session or credential theft. This impacts the confidentiality and integrity of user accounts.
Recommendation
Update N-able N-central to version 26.4.1 or later. Consider implementing security headers and content filtering.
Other vulnerabilities in N-able N-central
See all- CVE-2026-91000High
A missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central before 2026.4.1.
- CVE-2026-125958High
A download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central through 24.6.1.
- CVE-2026-125882High
N-able N-central contains a relative path traversal vulnerability that allows an attacker to manipulate file access paths. This issue affects N-central versions before 26.4.1.
- CVE-2026-125879High
N-able N-central contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects N-central versions before 26.4.1.
- CVE-2026-125878High
N-able N-central contains a cross-site scripting vulnerability caused by improper neutralization of input during web page generation, allowing resource injection. This issue affects N-central versions before 26.4.1.
- CVE-2026-125883Critical
N-able N-central before version 26.4.1 is vulnerable to improper restriction of XML external entity references, allowing XML Schema Poisoning. The issue affects versions prior to 26.4.1.
- CVE-2026-125881Critical
N-able N-central before version 26.4.1 contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to force server-side requests. The issue affects versions prior to 26.4.1.
- CVE-2026-18556HighActively exploited
Authentication bypass using an alternate path or channel vulnerability in N-able N-central through version 2026.1 allows authentication bypass.
- CVE-2025-8876HighActively exploited
Improper Input Validation vulnerability in N-able N-central allows OS Command Injection. This issue affects N-central before 2025.3.1.
- CVE-2025-8875HighActively exploited
Deserialization of untrusted data vulnerability in N-able N-central allows local code execution. Affects versions before 2025.3.1.
Original NVD description (English source)
Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS). This issue affects N-central: before 26.4.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS