CVE-2026-125878 is a high-severity cross-site scripting (XSS) vulnerability in N-able N-central versions before 26.4.1. It involves improper neutralization of input during web page generation, which can lead to resource injection. This flaw allows an attacker with low privileges to inject malicious scripts without user interaction. No known exploits are reported in the wild, and no official patch information is provided in the source data.