N-able said on Thursday, November 12, that it is investigating new public claims of additional vulnerabilities in on-premises N-central servers running version 2026.4.1 HF2, the hotfix it released on November 10 after a researcher published more than 30 alleged zero-days earlier in the week (see our earlier post, N-able Takes N-central Offline After 30+ Zero-Days Leak). N-central is a remote monitoring and management platform that IT providers use to administer their customers’ computers, so a server takeover can reach every device it manages. The Hacker News reports that the same researcher, Sean Bales, has now disclosed two more exploit chains and says the proof-of-concept code works against build 2026.4.1.26, the HF2 build.
According to the researcher as relayed by The Hacker News, 4EverAble2Shell gives an unauthenticated attacker remote code execution as root on the N-central server, and Agent2Shell uses more than 10 further zero-days to run commands as SYSTEM on managed Windows agents if the attacker knows the target appliance ID. N-able’s initial review, quoted by THN, is that the server issue “depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet.” The company says Legacy API is off by default and not recommended, and that hosted environments are not affected by this issue; it urges customers to turn it off immediately. Previdian’s report on 4EverAble2Shell describes the chain as unsafe class instantiation during SOAP fault processing in the bundled Apache Axis component, followed by separate weaknesses that escalate to root.
Exploitation attempts have started. Previdian’s Ryan Dewhurst told THN that targeted N-central probing followed within hours of the proof-of-concept release, from IP address 157.20.241[.]16, and that there is no evidence of successful exploitation so far. In the attack chain Previdian observed, the actor tried to get initial code execution through a recently disclosed Apache Axis flaw (CVE-2026-90436, CVSS 9.8, patched on November 6), then tried to escalate to root with 4EverAble2Shell and to download and run a shell script from that IP with curl. THN says watchTowr also reports probes for 4EverAble2Shell against N-central builds with the Legacy API enabled. Previdian’s own page lists two attempts from one IP in one country on November 12, states that exploitation attempts do not show a target was vulnerable or that an attempt succeeded, and says the complete affected-version range and a fixed build for this chain have not been verified.
How to check if you’re affected
Affected products are on-premises N-central servers; hosted N-central environments are not affected by this issue, according to N-able. Affected versions are not fully established: the researcher says the proof-of-concept works against 2026.4.1.26 (HF2), and Previdian says no fixed build for this chain has been verified. N-able’s HF2 release notes (November 10) list seven CVEs fixed by that hotfix, including XXE, OGNL injection and a path-traversal upload flaw, and say on-premises customers must upgrade their own servers and all customers must also upgrade Agents and Probes; those notes do not mention the Legacy API.
N-able’s stated step for this issue is to disable Legacy API immediately if it is on. Check whether your server has it enabled and reachable from the internet, and watch N-able’s status page for its advisory (the status event pages did not render for us, so we have not read them directly). If you run N-central on-premises, look in your web and proxy logs for requests from 157.20.241[.]16, the address Previdian reported; that check is our suggestion, not N-able’s guidance.
Sources
- N-able Status: N-central 2026.4 HF2 Release Notes (build 2026.4.1.26)
- Previdian: VULN-2026-0009, Exploitation Attempts Observed, N-central Remote Code Execution
- The Hacker News: New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
- N-able’s new advisory is on its status site (uptime.n-able.com/event/202609), linked from THN and Previdian; the page loaded as an empty shell, so N-able’s statements are as quoted by The Hacker News. The researcher’s exploit repository is linked from THN; we have not linked it here.