{"id":"CVE-2026-125878","kind":"vulnerability","aliases":["CVE-2026-125878"],"related":[],"title":"N-central: cross-site scripting flaw lets attackers inject web page code","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection.\n\nThis issue affects N-central: before 26.4.1.","summary":"N-able N-central has a cross-site scripting flaw in its web interface where input is not neutralized before being placed in a page. An attacker can inject scripts that run in a logged-in user's browser, which the sources describe as resource injection.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"N-central","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["msp","n-able","n-central","self-hosted","vendor"],"not_affected_if":["version-26.4.1-or-later"],"how_to_check":"- Check the installed N-central version in the product's admin interface or About page; the sources say versions before `26.4.1` are affected.","fix":"- N-central: move to `26.4.1` or later, per the sources.","status":"open","published_at":"2026-11-10T22:18:30+00:00","first_seen_at":"2026-11-10T22:27:29+00:00","triaged_at":"2026-11-10T22:28:53+00:00","updated_at":"2026-11-10T22:28:53+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T22:28:53Z","model":"claude-haiku-5-5","output":{"fix":"- N-central: move to `26.4.1` or later, per the sources.","reach":"unknown","title":"N-central: cross-site scripting flaw lets attackers inject web page code","impact":"medium","summary":"N-able N-central has a cross-site scripting flaw in its web interface where input is not neutralized before being placed in a page. An attacker can inject scripts that run in a logged-in user's browser, which the sources describe as resource injection.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["n-able","n-central","msp","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in an administrator's browser session","analyst_note":"Check the N-able security advisory for N-central 26.4.1 for attack prerequisites and whether an account is needed; the sources here only give the NVD description.","how_to_check":"- Check the installed N-central version in the product's admin interface or About page; the sources say versions before `26.4.1` are affected.","plain_action":"","product_name":"N-central","needs_analyst":true,"not_affected_if":["version-26.4.1-or-later"],"who_is_affected":"N-able N-central installations running versions before 26.4.1 are affected. The sources do not say which configurations or roles are needed to reach the flawed input, so the exposure of any given deployment is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4512,"output_tokens":524,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125878':17A,20A '-2026':16A,19A '26.4.1':115C 'abl':27B,37B,101C 'affect':110C 'allow':105C 'attack':10A,64B 'browser':77B 'central':3A,23A,30B,40B,104C,113C 'code':14A 'cross':5A,44B,94C 'cross-sit':4A,43B,93C 'cve':15A,18A 'describ':81B 'flaw':8A,47B 'generat':92C 'host':33B 'improp':85C 'inject':11A,66B,84B,107C 'input':53B,88C 'interfac':51B 'issu':109C 'let':9A 'log':73B 'logged-in':72B 'msp':24B 'n':2A,22A,26B,29B,36B,39B,100C,103C,112C 'n-abl':25B,35B,99C 'n-central':1A,21A,28B,38B,102C,111C 'neutral':56B,86C 'page':13A,62B,91C 'place':59B 'resourc':83B,106C 'run':69B 'script':7A,46B,67B,96C 'self':32B 'self-host':31B 'site':6A,45B,95C 'sourc':80B 'user':75B 'vendor':34B 'vulner':97C 'web':12A,50B,90C","nicknames":[],"mitigations":[],"who_affected":"N-able N-central installations running versions before 26.4.1 are affected. The sources do not say which configurations or roles are needed to reach the flawed input, so the exposure of any given deployment is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ncentral"],"ptokens":["central"],"labels":["high","msp","nable","ncentral","selfhosted","vendor"],"campaign_type":null,"search_a":"'-125878':17A,20A '-2026':16A,19A 'attack':10A 'central':3A,23A 'code':14A 'cross':5A 'cross-sit':4A 'cve':15A,18A 'flaw':8A 'inject':11A 'let':9A 'n':2A,22A 'n-central':1A,21A 'page':13A 'script':7A 'site':6A 'web':12A","search_b":"'abl':27B,37B 'attack':64B 'browser':77B 'central':30B,40B 'cross':44B 'cross-sit':43B 'describ':81B 'flaw':47B 'host':33B 'inject':66B,84B 'input':53B 'interfac':51B 'log':73B 'logged-in':72B 'msp':24B 'n':26B,29B,36B,39B 'n-abl':25B,35B 'n-central':28B,38B 'neutral':56B 'page':62B 'place':59B 'resourc':83B 'run':69B 'script':46B,67B 'self':32B 'self-host':31B 'site':45B 'sourc':80B 'user':75B 'vendor':34B 'web':50B","search_c":"'26.4.1':115C 'abl':101C 'affect':110C 'allow':105C 'central':104C,113C 'cross':94C 'cross-sit':93C 'generat':92C 'improp':85C 'inject':107C 'input':88C 'issu':109C 'n':100C,103C,112C 'n-abl':99C 'n-central':102C,111C 'neutral':86C 'page':91C 'resourc':106C 'script':96C 'site':95C 'vulner':97C 'web':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125878","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125878","severity":null,"published_at":"2026-11-10T22:18:30+00:00","modified_at":"2026-11-10T22:18:30+00:00","first_seen_at":"2026-11-10T22:27:29+00:00","fetched_at":"2026-11-10T22:27:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}