CVE-2026-125880: Stored XSS via MMS3 patch metadata (admin context)

Q: Which deployments are affected?

N-able N-central versions earlier than 26.4.1 are affected. Deployments running 26.4.1 or later are not identified as affected by the provided advisory data.

Q: What access and interaction are required for exploitation?

The CVSS vector indicates an attacker requires high privileges and that user interaction is required. The issue is network-reachable and has low attack complexity.

Q: What is the potential impact if exploitation succeeds?

The vulnerability can have high impact on confidentiality and integrity, with low impact on availability. The stated impact is limited to the vulnerable security authority; no subsequent-system impact is indicated.

Published Nov 10, 2026

Updated

Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS).

This issue affects N-central: before 26.4.1.

Affected Software

1 affected component

N-able N-Central<26.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade N-able N-central to a version that resolves this vulnerability.
Fixed in 26.4.1

Event History

Nov 10, 2026

CVE Published

via MITRE·09:26 PM

Data Sourced

via MITRE·09:26 PM

DescriptionWeakness

Data Sourced

via NVD·10:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

N-able N-central versions earlier than 26.4.1 are affected. Deployments running 26.4.1 or later are not identified as affected by the provided advisory data.

What access and interaction are required for exploitation?

The CVSS vector indicates an attacker requires high privileges and that user interaction is required. The issue is network-reachable and has low attack complexity.

What is the potential impact if exploitation succeeds?

The vulnerability can have high impact on confidentiality and integrity, with low impact on availability. The stated impact is limited to the vulnerable security authority; no subsequent-system impact is indicated.

CVE-2026-125880: Stored XSS via MMS3 patch metadata (admin context)

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access and interaction are required for exploitation?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access and interaction are required for exploitation?

What is the potential impact if exploitation succeeds?