What happened
On 12 November, security researcher Sean Bales published proof-of-concept exploits for two new N-able N-central issues, named 4EverAble2Shell and Agent2Shell. They work against the latest emergency build, 2026.4 HF2 (build 2026.4.1.26), which N-able shipped on 10 November to fix an earlier set of flaws.
4EverAble2Shell gives an unauthenticated attacker root-level command execution on an N-central server. It chains an Apache Axis vulnerability, CVE-2026-90436 (CVSS 9.8), with a separate N-central privilege escalation weakness. Exploitation requires the platform's Legacy API to be enabled, which is not the default.
Within hours of the PoC landing, attackers were running the full chain against production servers. Huntback and Lupovis confirmed 21 compromised N-central servers, 19 of them running Hotfix 2. The payload seen so far is an XMRig Monero miner, but N-central manages customer endpoints, so a hit means an attacker has root on the box that runs your clients.
Timeline
- 10 Nov: N-able releases 2026.4 HF2.
- 12 Nov: Bales publishes 4EverAble2Shell and Agent2Shell PoC code.
- 12 Nov, about 08:30 UTC: probes hit Previdian and Huntback honeypots from the same attacker IP.
- 12 Nov, 09:16 UTC: first full exploit chain run against decoys.
- 12 Nov, 12:50 UTC: researchers count 21 active miners, all with recent mining shares.
- 13 Nov: N-able reports additional indicators of compromise and restricts features.
Am I affected?
You are exposed if you run on-premises N-central and have the Legacy API enabled and reachable from the internet. Running Hotfix 2 does not protect you: 19 of the 21 compromised servers were on HF2.
Hosted N-central customers: N-able says it has applied the new protections to hosted environments and disabled the Intune integration. Follow N-able status updates.
Agent2Shell targets communication between N-central servers and Windows Agents and Probes, and can reach SYSTEM on managed devices. IP allowlisting alone may not help because those interfaces also handle normal Agent and Probe traffic.
What to do now
- Confirm the Legacy API is disabled. It is off by default. If it is on, disable it.
- Take on-premises N-central servers offline or remove internet access, as Huntback and Huntress advise, even after installing HF2.
- Block inbound access to the exposed interfaces at the perimeter. Do not rely on IP allowlisting alone.
- Treat any confirmed hit as a full compromise, not a cleanup job. Rotate credentials and secrets held by the appliance and review managed customer environments.
- Continue upgrading Agents and Probes under the earlier Hotfix 2 guidance, but do not treat HF2 as a fix for these new flaws.
- Watch N-able advisories for the next hotfix. No patch for 4EverAble2Shell existed at publication time.
How to hunt
On the N-central server, review logs for unusual requests to /dms/services/ServerUI and /dms2/services2/ServerMMS2, especially messages using a session ID of -1.
Look for the known attack infrastructure: payloads downloaded from and output sent to 157.20.241[.]16.
Check for unexpected script backup files and a suspicious symbolic link involving flag_default.json. The chain abuses the privileged setLDFileOwner helper and a symlink to make a root-owned script writable, then restores the files afterwards.
Look for an XMRig miner, often using about half the available CPU cores and running with systemd or cron persistence. Miner identifiers begin with nc_ followed by the server IP.
On Windows devices, examine unexpected encoded PowerShell launched by N-able components, changes to Windows Software Probe files, and unexplained service restarts. Normal support work can look similar, so check context. Review activity from 11 November onward.
What does not help
Installing Hotfix 2 alone does not protect you: most compromised servers were on HF2. IP allowlisting alone may not be enough, because the affected interfaces also carry legitimate Agent and Probe connections.
Sources
- New N-able "4EverAble2Shell" zero-day exploited hours after PoC released, BleepingComputer, 12 Nov
- Hackers Exploit New N-central Zero-Day Hours After PoC Publication, SecurityWeek, 13 Nov
- New N-able N-central Zero-Day Exploits Target Patched Servers, Claiming Unauthenticated Root Access, Cyber Security News, 12 Nov
- New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access, The Hacker News, 12 Nov
- Hackers Target N-central Zero-Days as N-able Rushes Patches, SecurityWeek, 12 Nov
- Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2, The Hacker News, 13 Nov
