New N-able N-central Zero-Days “4EverAble2Shell” and “Agent2Shell” Bypass Able2Shell Hotfix; Exploitation Attempts Already Seen

N-able says it is investigating a new public disclosure of more vulnerabilities in on-premise N-central servers running version 2026.4.1 HF2. That is the hotfix it released only days ago to fix the Able2Shell vulnerabilities. Public proof-of-concept (PoC) exploits are available, and threat intelligence firms have already seen targeted probing within hours of their release.

Background: Able2Shell
Earlier this week, independent security researcher Sean Bales disclosed several security flaws in N-central, tracked together as Able2Shell. On November 10, 2026, N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) to fix them.

The new vulnerabilities
Bales has now published two more attack chains, along with PoC exploits that he says work against the patched build 2026.4.1.26:

• 4EverAble2Shell: Enables unauthenticated remote code execution with root privileges on N-central servers.
• Agent2Shell: Chains more than 10 zero-day vulnerabilities to run commands as NT AUTHORITY\SYSTEM on managed Windows agents. The attacker needs to know the target appliance ID.

Agent2Shell is particularly concerning in MSP environments. A single compromised N-central server could give attackers SYSTEM-level command execution across many downstream customer endpoints.

N-able’s response
N-able says its initial review shows the server issue depends on a non-default configuration: the Legacy API is turned on and exposed to the public internet. The Legacy API is off by default and not recommended. N-able is urging customers to disable it immediately if they haven’t already.

The issue affects these services:

• N-central On-premise (Americas)
• N-central On-premise (APAC)
• N-central On-premise (Europe)

Hosted N-central environments are not affected.

Exploitation attempts in the wild
Ryan Dewhurst, founder and CEO of Previdian, said his company saw targeted N-central probing for 4EverAble2Shell within hours of the PoC release. In the observed attack chain, threat actors:

1. Attempted initial code execution through CVE-2026-90436 (CVSS 9.8), a recently disclosed Apache Axis flaw that was patched on November 6, 2026.
2. Attempted to escalate to root privileges using 4EverAble2Shell.
3. Attempted to download and run a shell script from the attacker’s server using curl.

According to Dewhurst, this is the first documented exploitation attempt targeting CVE-2026-90436. There is no evidence of successful exploitation so far. watchTowr also reported seeing 4EverAble2Shell probes targeting N-central builds with the Legacy API enabled.

Indicators of compromise

Recommendations

• Disable the Legacy API right away on all on-premise N-central servers, and make sure it is not exposed to the internet.
• Make sure you’re running build 2026.4.1.26 to fix the original Able2Shell flaws. Note that it does not fix the new issues, so watch N-able’s advisories for a further fix.
• Restrict internet exposure of N-central servers; where possible, put them behind a VPN or allow-list access.
• Block and hunt for 157.20.241[.]16 in firewall, proxy, and EDR logs, including outbound curl connections from N-central servers.
• Review N-central servers for unexpected processes, new files, shell scripts, or cron jobs, and check Apache Axis-related logs for exploitation attempts.
• Monitor managed Windows agents for unusual commands running as NT AUTHORITY\SYSTEM that come from the N-central agent.
• MSPs should notify their customers and be ready for incident response, given the possible downstream impact.

We will update this post as N-able releases further fixes or if successful exploitation is confirmed.