{"id":"CVE-2026-125880","kind":"vulnerability","aliases":["CVE-2026-125880"],"related":[],"title":"N-able N-central: HTTP header handling lets attackers run scripts in browsers","description":"Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS).\n\nThis issue affects N-central: before 26.4.1.","summary":"N-able N-central has an HTTP header neutralization flaw that allows cross-site scripting. An attacker who gets a crafted request to a user can run scripts in that user's browser session.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"N-central","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["msp","n-able","n-central","vendor"],"not_affected_if":["already-on-26.4.1"],"how_to_check":"- Check the installed N-central version in the admin console and compare it to the fixed release.","fix":"- N-central: upgrade to `26.4.1` or later","status":"open","published_at":"2026-11-10T22:18:30+00:00","first_seen_at":"2026-11-10T22:27:29+00:00","triaged_at":"2026-11-10T22:29:01+00:00","updated_at":"2026-11-10T22:29:01+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T22:29:01Z","model":"claude-haiku-5-5","output":{"fix":"- N-central: upgrade to `26.4.1` or later","reach":"internet","title":"N-able N-central: HTTP header handling lets attackers run scripts in browsers","impact":"medium","summary":"N-able N-central has an HTTP header neutralization flaw that allows cross-site scripting. An attacker who gets a crafted request to a user can run scripts in that user's browser session.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["n-central","n-able","msp"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Scripts run in a logged-in administrator's browser session","analyst_note":"Confirm the vendor advisory for N-able N-central 26.4.1 and whether authentication or a specific request path is required.","how_to_check":"- Check the installed N-central version in the admin console and compare it to the fixed release.\n- unknown","plain_action":"","product_name":"N-central","needs_analyst":true,"not_affected_if":["already-on-26.4.1"],"who_is_affected":"N-central installations before `26.4.1` are affected, since the flaw is in the product's HTTP handling. Hosted deployments are covered by the vendor's own patching, so the team that runs the server must confirm its version. Teams with no N-central instance can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":4525,"output_tokens":509,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125880':18A,21A '-2026':17A,20A '26.4.1':99C 'abl':3A,28B,35B,82C 'affect':94C 'allow':46B,86C 'attack':11A,52B 'browser':15A,68B 'central':6A,24A,31B,38B,85C,97C 'craft':56B 'cross':48B,88C 'cross-sit':47B,87C 'cve':16A,19A 'flaw':44B 'get':54B 'handl':9A 'header':8A,42B,74C 'http':7A,41B,73C 'improp':70C 'issu':93C 'let':10A 'msp':25B 'n':2A,5A,23A,27B,30B,34B,37B,81C,84C,96C 'n-abl':1A,26B,33B,80C 'n-central':4A,22A,29B,36B,83C,95C 'neutral':43B,71C 'request':57B 'run':12A,62B 'script':13A,50B,63B,76C,90C 'session':69B 'site':49B,89C 'syntax':77C 'user':60B,66B 'vendor':32B 'vulner':78C 'xss':91C","nicknames":[],"mitigations":[],"who_affected":"N-central installations before `26.4.1` are affected, since the flaw is in the product's HTTP handling. Hosted deployments are covered by the vendor's own patching, so the team that runs the server must confirm its version. Teams with no N-central instance can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ncentral"],"ptokens":["central"],"labels":["high","msp","nable","ncentral","vendor"],"campaign_type":null,"search_a":"'-125880':18A,21A '-2026':17A,20A 'abl':3A 'attack':11A 'browser':15A 'central':6A,24A 'cve':16A,19A 'handl':9A 'header':8A 'http':7A 'let':10A 'n':2A,5A,23A 'n-abl':1A 'n-central':4A,22A 'run':12A 'script':13A","search_b":"'abl':28B,35B 'allow':46B 'attack':52B 'browser':68B 'central':31B,38B 'craft':56B 'cross':48B 'cross-sit':47B 'flaw':44B 'get':54B 'header':42B 'http':41B 'msp':25B 'n':27B,30B,34B,37B 'n-abl':26B,33B 'n-central':29B,36B 'neutral':43B 'request':57B 'run':62B 'script':50B,63B 'session':69B 'site':49B 'user':60B,66B 'vendor':32B","search_c":"'26.4.1':99C 'abl':82C 'affect':94C 'allow':86C 'central':85C,97C 'cross':88C 'cross-sit':87C 'header':74C 'http':73C 'improp':70C 'issu':93C 'n':81C,84C,96C 'n-abl':80C 'n-central':83C,95C 'neutral':71C 'script':76C,90C 'site':89C 'syntax':77C 'vulner':78C 'xss':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125880","severity":null,"published_at":"2026-11-10T22:18:30+00:00","modified_at":"2026-11-10T22:18:30+00:00","first_seen_at":"2026-11-10T22:27:29+00:00","fetched_at":"2026-11-10T22:27:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}