Search: CVE-2026-125880

CVE-2026-125880 is a high-severity vulnerability in N-able N-central before version 26.4.1. It involves improper neutralization of HTTP headers for scripting syntax, leading to a Cross-Site Scripting (XSS) vulnerability. This flaw allows an attacker with high privileges and user interaction to execute scripts in the context of the affected application. The issue is fixed in version 26.4.1.

Able2Shell is a collection of 33 reported zero-day vulnerabilities in N-able N-central, disclosed publicly with proof-of-concept code. Among these, seven critical vulnerabilities have been officially recognized and patched by N-able in the N-central 2026.4 Hotfix 2 release. The vulnerabilities include high-severity issues such as XML external entity (XXE) attacks, server-side request forgery (SSRF), OGNL injection, local privilege escalation, remote code execution, and stored cross-site scripting (XSS). One exploit chain allows unauthenticated remote command execution as the nable user, and others can lead to root privileges through chained exploits. N-able has confirmed and patched the most critical issues but has not mapped all 33 findings individually. The affected versions are N-central prior to 2026.4.1.26. No confirmed customer compromises have been reported as of November 10, 2026.