N-central 4EverAble2Shell Zero-Day Hits Patched Servers
Attackers began exploiting a new N-able N-central zero-day, 4EverAble2Shell, hours after a public exploit appeared, compromising at least 21 servers, 19 of them on the latest security update.
⚡ Why it matters
MSPs use N-central to manage customer devices remotely, so a compromised server can open the door to dozens of client networks at once.
Earlier this week, independent researcher Sean Bales published more than 30 N-central zero-days under the name Able2Shell. N-able took its hosted environments offline and shipped an emergency update, 2026.4 Hotfix 2, on November 10. Two days later, on November 12, Bales released two new exploits that work against that same update:
- 4EverAble2Shell: unauthenticated remote code execution (RCE) as root on N-central servers, if the Legacy API feature is enabled. It chains an Apache Axis flaw,
CVE-2026-90436(CVSS 9.8), with an N-central privilege escalation bug. - Agent2Shell: uses more than 10 flaws to run commands as SYSTEM on managed Windows devices, if the attacker knows the appliance ID.
Active exploitation
Threat intelligence firms saw targeted probing within hours of the PoC release, followed by real attacks that dropped cryptominers. At least 21 servers were reported compromised, 19 of them running the latest update.
N-able's response
N-able says the server issue depends on a non-default setup where Legacy API is enabled and exposed to the internet. For hosted customers it switched Legacy API off by default and temporarily disabled the Intune integration.
What to do now
- Disable Legacy API immediately and do not expose the server directly to the internet.
- Upgrade all Agents and Probes to 2026.4 HF1 or later, since the update changes how they communicate.
- Hunt for compromise: miner processes, curl downloads from unknown IPs, or new accounts.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
FBI Warns Artex AI Tool Automates Hacks at Machine Speed
The FBI issued a flash alert about Artex, an open-source pentesting platform that plugs any LLM into AI agents that run attack stages automatically. Some intrusions reached privileged access in under three hours.
Xen Orchestra Auth Bypass Exploited to Take Over XCP-ng
French vendor Vates warned that a critical flaw in Xen Orchestra, the management tool for XCP-ng virtualization, is under active exploitation. A crafted cookie bypasses authentication, granting admin rights and root control of hosts.
Cisco BroadWorks and Openwave Flaws Exploited, Added to KEV
On Tuesday, November 10, CISA listed two flaws, one in Cisco BroadWorks and one in Openwave Messaging Webtop Media Transcoder, in its Known Exploited Vulnerabilities (KEV) catalog, even though fixes have been out for months.