New N-central Vulnerabilities Enable Root RCE and System Access
Security researcher Sean Bales identifies critical exploits affecting N-central servers with legacy configurations.
1Critical N-central Security Flaws
N-able is currently investigating new vulnerabilities identified in on-premise versions of its N-central software, specifically build 2026.4.1 HF2. These flaws, collectively codenamed 4EverAble2Shell and Agent2Shell, allow attackers to achieve unauthenticated remote code execution with root privileges. The company confirms that hosted environments remain unaffected by these specific security shortcomings at this time.
2Legacy API Configuration Risks
The identified server issues depend on a non-default configuration where the Legacy API is enabled and exposed to the public internet. N-able emphasizes that this API is disabled by default and strongly advises against its use. Customers are urged to disable this feature immediately to prevent potential unauthorized access to their systems.
3Researcher Discloses New Exploits
Security researcher Sean Bales revealed these vulnerabilities shortly after N-able released a patch for a previous set of flaws known as Able2Shell. The new exploits, 4EverAble2Shell and Agent2Shell, successfully target the very update released on November 10, 2026, intended to resolve earlier security issues, highlighting a rapid cycle of discovery.
4System Level Access Potential
Agent2Shell leverages over ten zero-day vulnerabilities to execute commands on managed Windows agents with NT AUTHORITY\SYSTEM privileges. This level of access is achievable if an attacker possesses the target appliance ID. Such deep system control poses a significant risk to organizations relying on N-central for managing their internal network infrastructure.
5Observed Exploitation Attempts
Ryan Dewhurst, CEO of Previdian, reported that targeted probing for 4EverAble2Shell began within hours of the proof-of-concept release. Activity originated from the IP address 157.20.241.16, though no evidence of successful exploitation has been confirmed yet. Security firms like watchTowr are also monitoring probes specifically targeting N-central builds with Legacy APIs enabled.
6Attack Chain Mechanism Analysis
Threat actors are attempting to chain these vulnerabilities with a recently disclosed Apache Axis flaw, tracked as CVE-2026-90436 with a CVSS score of 9.8. The attack sequence involves achieving initial code execution, escalating to root privileges via 4EverAble2Shell, and then downloading malicious shell scripts from external servers using standard curl commands.
7First Instance of Exploitation
This situation marks the first documented instance of exploitation attempts targeting the Apache Axis vulnerability CVE-2026-90436. Patches for this specific flaw were originally made available on November 6, 2026. The rapid weaponization of these vulnerabilities underscores the critical importance of timely patch management and reducing the attack surface of enterprise software.
8Ongoing Security Response Efforts
As this story develops, N-able continues to investigate the full scope of the vulnerabilities while urging users to secure their configurations. Organizations should prioritize disabling the Legacy API and monitoring for unauthorized traffic from suspicious IP addresses. Maintaining visibility into identity gaps and attack surfaces remains essential for defending against emerging threats.
Original article: The Hacker News — New N-central Vulnerabilities Enable Root RCE and System Access