Emerging ThreatsMalware & Ransomware

New Exploits Target N-central Servers, Enable Root Code Execution

Analyst 207||Source: TheHackerNews
Server room with computer racks, one partially pulled out with exposed cables and a blank console screen.

"Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet," N-able said in a new advisory.

N-able advisory and the scope of impact

N-able published an advisory after independent researcher Sean Bales disclosed additional exploit code aimed at on-premise versions of N-central running 2026.4.1 HF2. The company said Legacy API is turned off by default, is not recommended, and urged customers to disable Legacy API immediately if it is enabled. N-able also said Hosted environments are not affected.

The advisory listed the impacted deployments as N-central On-premise (Americas), N-central On-premise (APAC), and N-central On-premise (Europe).

4EverAble2Shell and Agent2Shell: the new exploit claims

Bales, the researcher who disclosed the earlier set of flaws known as Able2Shell, published proof-of-concept (PoC) exploits codenamed 4EverAble2Shell and Agent2Shell. According to Bales, 4EverAble2Shell enables unauthenticated remote code execution with root privileges on N-central servers. Agent2Shell is described as leveraging more than 10 zero-day vulnerabilities to run commands on managed Windows agents as NT AUTHORITY\SYSTEM, with the caveat "assuming the attacker knows the target appliance ID."

N-able acknowledged the new public disclosure and said it is investigating the claims. The PoC exploits reportedly work against N-central 2026.4 Hotfix 2 (build 2026.4.1.26), the update N-able released on November 10, 2026, to address the earlier Able2Shell vulnerabilities.

Observed probing, the attack chain, and indicators

Previdian founder and CEO Ryan Dewhurst told The Hacker News that probes targeting 4EverAble2Shell were observed within hours after the PoC was published. The activity was reported as originating from the IP address 157.20.241[.]16. Dewhurst also described an observed attack chain in which actors attempted initial code execution through an Apache Axis flaw tracked as CVE-2026-90436 (CVSS 9.8), then attempted to escalate to root with 4EverAble2Shell, and finally to download and execute a shell script from 157.20.241[.]16 using curl.

Dewhurst added that this is the first documented instance of exploitation attempts aimed at CVE-2026-90436; patches for that Apache Axis flaw were released on November 6, 2026. The Hacker News report says there was no evidence of successful exploitation as of writing.

WatchTowr, in a post on X, reported seeing probes for 4EverAble2Shell specifically targeting N-central builds with the Legacy API enabled.

Immediate mitigations: disable Legacy API and note affected builds

N-able's advisory centers on configuration: Legacy API must be disabled if it has been turned on and exposed to the public internet. The company emphasized Legacy API is off by default and not recommended. The PoC workarounds and exploit demonstrations were reported to apply to N-central 2026.4 Hotfix 2 (build 2026.4.1.26), the hotfix N-able issued on November 10, 2026.

What this means for N-central customers, security teams, and managed Windows agents

  • N-central customers and administrators: N-able explicitly urged them to disable the Legacy API immediately if it is enabled; hosted customers were told they are not affected by this issue.
  • Security teams and incident responders: The reportered probing originated from 157.20.241[.]16 and used an attack chain beginning with CVE-2026-90436; teams will likely watch logs for attempts that follow that pattern and for connections to the flagged IP.
  • Operators of managed Windows agents: The Agent2Shell claims, if accurate, would let an attacker run commands as NT AUTHORITY\SYSTEM on agents where the attacker knows an appliance ID—an explicit precondition noted by the researcher.

The public disclosures and rapid probing underscore two concrete points recorded in the advisory and researcher reporting: the new PoCs target a specific on-premise build (2026.4.1.26) and depend on a non-default, internet-exposed Legacy API setting. N-able is investigating; customers have been told how to reduce immediate exposure, and multiple observers have reported scanning activity tied to the new PoCs but no confirmed successful exploitations at the time of reporting.

Original reporting: https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html

Emerging ThreatsVulnerability ManagementServer SecurityExploit CodeRoot Code ExecutionRMM SoftwareN-centralRemote MonitoringLegacy APIOn-premise Servers
Related Intelligence

Continue Reading

Brightly-lit server room with rows of servers and screens displaying software interfaces.

Hackers Exploit ScreenConnect Flaw to Spread Malware

Malicious hackers have exploited a vulnerability in a third-party extension for ScreenConnect, infecting at least 288 machines across 48 organizations with malware in a matter of minutes. The attack, first flagged by Huntress, highlights the risks of compromised software extensions, even when the main infrastructure is secure.

Analyst 207
Busy office scene with a cluttered desk and blank laptop screen amidst coworkers.

Lego Shuts Down BrickLink After Detecting Suspicious Activity

The Lego Group swiftly took down BrickLink Marketplace after detecting unusual activity, prioritizing member safety and site security. They're now investigating the issue and working to restore service once they've fully understood what happened.

Analyst 207
Person sitting at desk, looking at laptop with calendar event on screen.

Google Session Hijacking Campaign Exposes Sophisticated Phishing Tactics

Malicious actors have launched a massive Google Session Hijacking campaign, luring victims with seemingly harmless calendar invites that mask sophisticated phishing tactics. These cleverly crafted messages, often sent via BCC or from familiar organizations, conceal malicious links behind a façade of legitimacy.

Analyst 207
Logistics worker stands by container with ajar door, revealing paperwork and computer screen.

Maersk Exposes Data Breach After Extortion Group Targets Logistics Data

Maersk has confirmed a data breach after an extortion group claimed to have stolen 100GB of sensitive logistics data from one of its systems. The incident, which affected a local legacy system from a previous acquisition, appears to be isolated with no indication of a wider impact on Maersk's systems or those of its customers and partners.

Analyst 207