New N-central Exploits Enable Root RCE and SYSTEM Access, Even on Patched Servers
N-able is investigating new public disclosures of vulnerabilities in N-central version 2026.4.1 HF2, with exploits targeting the Legacy API to achieve remote code execution.
N-able is actively investigating new public disclosures detailing vulnerabilities in its on-premise N-central software, specifically affecting version 2026.4.1 HF2. These newly revealed exploits, codenamed 4EverAble2Shell and Agent2Shell, are reportedly capable of achieving significant system compromise, including root-level remote code execution (RCE) on Linux systems and SYSTEM-level access on Windows.
According to N-able's advisory, the successful exploitation of these vulnerabilities hinges on a specific, non-default configuration where the Legacy API is enabled and exposed to the public internet. The company emphasizes that this Legacy API is disabled by default and its use is not recommended, urging customers to disable it immediately if it has been activated. Hosted N-central environments are confirmed to be unaffected by this particular issue.
The emergence of these new exploits follows closely on the heels of N-able's release of version 2026.4.1.26 on November 10, 2026. This update was intended to address a set of vulnerabilities collectively known as Able2Shell, which were disclosed by independent security researcher Sean Bales. However, the new 4EverAble2Shell and Agent2Shell vulnerabilities, also revealed by Bales, appear to bypass the protections implemented in that recent hotfix.
Specifically, 4EverAble2Shell is described as enabling unauthenticated RCE with root privileges on N-central servers. Agent2Shell, on the other hand, leverages a chain of over ten zero-day vulnerabilities to execute commands on managed Windows agents with the highest level of privilege (NT AUTHORITY\SYSTEM), provided the attacker knows the target appliance ID.
Security researchers have already observed probing activity targeting 4EverAble2Shell within hours of the proof-of-concept exploits becoming public. Threat intelligence from Previdian noted observed activity originating from the IP address 157.20.241[.]16, though no successful exploitation had been confirmed at the time of reporting. This observed attack chain involved an initial attempt at code execution using a recently disclosed Apache Axis flaw (CVE-2026-90436), followed by an attempt to escalate privileges using 4EverAble2Shell, and then downloading and executing a shell script.
The exploitation attempts targeting CVE-2026-90436 are significant as they mark the first documented instances of this vulnerability being weaponized in the wild. Patches for CVE-2026-90436 were released on November 6, 2026, underscoring the rapid pace at which attackers are adapting and exploiting newly disclosed, high-severity flaws.
WatchTowr also confirmed observing probes for 4EverAble2Shell, specifically targeting N-central builds that had the Legacy API enabled. This widespread interest from threat actors highlights the critical importance of adhering to N-able's recommendation to disable the Legacy API and ensure systems are properly configured and patched.
This situation underscores a persistent challenge in cybersecurity: the rapid development and exploitation of vulnerabilities, even shortly after patches are released. Organizations relying on N-central must remain vigilant, ensuring their configurations are secure and that they promptly apply all available updates and follow vendor guidance to mitigate risks.