N-central exploits work against patched servers when Legacy API is exposed
N-able is investigating a public disclosure of additional vulnerabilities in on-premise N-central servers running version 2026.4.1 HF2, the company said in an advisory. The exploits also work against build 2026.4.1.26, which N-able released on November 10 to address the earlier Able2Shell vulnerabilities, according to the advisory.
The new issue requires N-central’s Legacy API to be enabled and exposed to the public internet, N-able said. The API is disabled by default and the company does not recommend using it. N-able urged customers to disable Legacy API immediately if it is enabled. The company said the issue affects its on-premise deployments in the Americas, APAC and Europe, while hosted environments are not affected.
Security researcher Sean Bales named the new exploit chains 4EverAble2Shell and Agent2Shell, according to The Hacker News. The researcher said 4EverAble2Shell allows unauthenticated remote code execution with root privileges on N-central servers. Agent2Shell uses more than 10 zero-day vulnerabilities to run commands on managed Windows agents as NT AUTHORITY\SYSTEM when the attacker knows the target appliance ID.
Previdian founder Ryan Dewhurst told The Hacker News that targeted probing for 4EverAble2Shell began within hours after the proof of concept was released. He said the activity came from 157.20.241[.]16, but the report said there was no evidence of successful exploitation at the time of writing. WatchTowr separately reported probes against N-central builds with Legacy API enabled.
The observed activity attempted to gain initial code execution through Apache Axis vulnerability CVE-2026-90436 and then escalate to root with 4EverAble2Shell, Dewhurst said. The attackers also attempted to download and execute a shell script from 157.20.241[.]16 using curl. Dewhurst described this as the first documented exploitation attempt against CVE-2026-90436; patches for that flaw were released on November 6, according to the report.