N-CENTRAL · CVE-2026-125880 · Vendor
NO FIX YET · SEE WHAT TO DO
N-able N-central has an HTTP header neutralization flaw that allows cross-site scripting. An attacker who gets a crafted request to a user can run scripts in that user's browser session.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
N-central installations before 26.4.1 are affected, since the flaw is in the product's HTTP handling. Hosted deployments are covered by the vendor's own patching, so the team that runs the server must confirm its version. Teams with no N-central instance can skip it.
Not affected if already-on-26.4.1
Who cares msp, n-able, n-central
26.4.1 or laterImproper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS).
This issue affects N-central: before 26.4.1.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.