> ## Content Index
> Fetch the complete content index at: https://cms.thedarkwebnews.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# New N-able N-central Zero-Days “4EverAble2Shell” and “Agent2Shell” Bypass Able2Shell Hotfix; Exploitation Attempts Already Seen
- URL: https://cms.thedarkwebnews.com/new-n-able-n-central-zero-days-4everable2shell-and-agent2shell-bypass-able2shell-hotfix-exploitation-attempts-already-seen/
- Published: 2026-11-12T12:11:35.000Z
- Updated: 2026-11-12T12:11:35.000Z
- Author: Darkintel Team
- Tags: Malware, Patch

N-able says it is investigating a new public disclosure of more vulnerabilities in on-premise N-central servers running version 2026.4.1 HF2\. That is the hotfix it released only days ago to fix the Able2Shell vulnerabilities. Public proof-of-concept (PoC) exploits are available, and threat intelligence firms have already seen targeted probing within hours of their release.

**Background: Able2Shell**  
Earlier this week, independent security researcher Sean Bales disclosed several security flaws in N-central, tracked together as **Able2Shell**. On November 10, 2026, N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) to fix them.

**The new vulnerabilities**  
Bales has now published two more attack chains, along with PoC exploits that he says work against the patched build 2026.4.1.26:

- **4EverAble2Shell:** Enables unauthenticated remote code execution with root privileges on N-central servers.
- **Agent2Shell:** Chains more than 10 zero-day vulnerabilities to run commands as `NT AUTHORITY\SYSTEM` on managed Windows agents. The attacker needs to know the target appliance ID.

Agent2Shell is particularly concerning in MSP environments. A single compromised N-central server could give attackers SYSTEM-level command execution across many downstream customer endpoints.

**N-able’s response**  
N-able says its initial review shows the server issue depends on a non-default configuration: the **Legacy API is turned on and exposed to the public internet**. The Legacy API is off by default and not recommended. N-able is urging customers to disable it immediately if they haven’t already.

The issue affects these services:

- N-central On-premise (Americas)
- N-central On-premise (APAC)
- N-central On-premise (Europe)

**Hosted N-central environments are not affected.**

**Exploitation attempts in the wild**  
Ryan Dewhurst, founder and CEO of Previdian, said his company saw targeted N-central probing for 4EverAble2Shell within hours of the PoC release. In the observed attack chain, threat actors:

1. Attempted initial code execution through **CVE-2026-90436** (CVSS 9.8), a recently disclosed Apache Axis flaw that was patched on November 6, 2026.
2. Attempted to escalate to root privileges using 4EverAble2Shell.
3. Attempted to download and run a shell script from the attacker’s server using `curl`.

According to Dewhurst, this is the first documented exploitation attempt targeting CVE-2026-90436\. There is no evidence of successful exploitation so far. watchTowr also reported seeing 4EverAble2Shell probes targeting N-central builds with the Legacy API enabled.

**Indicators of compromise**

| Type | Indicator         | Context                                                                                                     |
| ---- | ----------------- | ----------------------------------------------------------------------------------------------------------- |
| IPv4 | 157.20.241\[.\]16 | Source of 4EverAble2Shell probing and host of the shell script downloaded with curl (observed by Previdian) |
| CVE  | CVE-2026-90436    | Apache Axis flaw used for initial code execution attempts                                                   |

**Recommendations**

- **Disable the Legacy API right away** on all on-premise N-central servers, and make sure it is not exposed to the internet.
- **Make sure you’re running build 2026.4.1.26** to fix the original Able2Shell flaws. Note that it does not fix the new issues, so watch N-able’s advisories for a further fix.
- **Restrict internet exposure** of N-central servers; where possible, put them behind a VPN or allow-list access.
- **Block and hunt for 157.20.241\[.\]16** in firewall, proxy, and EDR logs, including outbound `curl` connections from N-central servers.
- **Review N-central servers** for unexpected processes, new files, shell scripts, or cron jobs, and check Apache Axis-related logs for exploitation attempts.
- **Monitor managed Windows agents** for unusual commands running as `NT AUTHORITY\SYSTEM` that come from the N-central agent.
- **MSPs should notify their customers** and be ready for incident response, given the possible downstream impact.

We will update this post as N-able releases further fixes or if successful exploitation is confirmed.