New 4EverAble2Shell and Agent2Shell Exploits Target N-able N-central 2026.4.1 HF2, Enabling Root and SYSTEM RCE
N-able is investigating newly disclosed vulnerabilities named 4EverAble2Shell and Agent2Shell affecting on-premise N-central version 2026.4.1 HF2. The primary risk arises when the Legacy API feature—disabled by default—is enabled and exposed to the public internet. 4EverAble2Shell allows unauthenticated remote code execution with root privileges on N-central servers, while Agent2Shell exploits multiple zero-day flaws to execute commands as SYSTEM on managed Windows agents if the attacker knows the appliance ID. These exploits bypass the recent patch 2026.4.1.26 released November 10, 2026, for the earlier Able2Shell vulnerabilities. Active probing has been observed from IP 157.20.241.16 leveraging also the high-severity CVE-2026-90436 Apache Axis vulnerability as an initial access vector. Hosted N-central environments are not affected. Immediate disablement of Legacy API is strongly advised by N-able.
Entenda a falha
A vulnerabilidade
4EverAble2Shell is an unauthenticated remote code execution flaw giving root on on-premise N-able N-central 2026.4.1 HF2 (build 2026.4.1.26). N-able says it depends on a non-default setup where the Legacy API is turned on and exposed to the internet. Agent2Shell chains more than 10 zero-days to run commands as NT AUTHORITY\SYSTEM on managed Windows agents, provided the attacker knows the appliance ID. Both bypass the 2026.4.1.26 patch for the earlier Able2Shell flaws, and no fixed version is mentioned yet. CVE-2026-90436 (CVSS 9.8) is a separate Apache Axis flaw, patched on November 6, 2026, which attackers have tried as an initial foothold. Hosted N-central is not affected.
Como funciona
The articles give few technical details. For 4EverAble2Shell, a remote request reaches the N-central server through the Legacy API, which is off by default but reachable if enabled and published to the internet. The server processes it without authentication, and the result is code running as root. For Agent2Shell, the attacker targets a managed Windows agent using the appliance ID and several flaws to get commands run as SYSTEM. In the attack chain Previdian observed, the actor first tried to get code execution through the Apache Axis flaw CVE-2026-90436, then tried to escalate to root with 4EverAble2Shell.
Por que é vulnerável
The articles do not state the root cause of 4EverAble2Shell or Agent2Shell. What they show is that the exposure comes from the Legacy API, an unrecommended feature, and that the 2026.4.1.26 patch for Able2Shell did not close these new paths. For Agent2Shell, the researcher counts more than 10 separate zero-days. No fix is described, so N-able's mitigation is to disable the Legacy API.
Como foi descoberta
Independent researcher Sean Bales disclosed 4EverAble2Shell and Agent2Shell publicly, days after his Able2Shell findings led N-able to release 2026.4.1.26 on November 10, 2026. N-able said on Thursday it is investigating the new claims. Previdian's Ryan Dewhurst reported probing from IP 157.20.241.16 within hours of the PoC release, and watchTowr also reported probes against N-central builds with the Legacy API enabled. There is no evidence of successful exploitation so far. Dewhurst called this the first documented exploitation attempt against CVE-2026-90436.
PoC pública
Bales released proof-of-concept exploits that, per the articles, work against N-central 2026.4 HF2 (build 2026.4.1.26), including the build patched for Able2Shell. Attackers started probing within hours of the release, which makes disabling the Legacy API urgent. Previdian saw an attempted chain of the Apache Axis flaw, then 4EverAble2Shell for root, then a shell script downloaded with curl, with no confirmed success. The articles give no link to the PoC.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 11:15.
Linha do tempo
-
New 4EverAble2Shell and Agent2Shell Exploits Target N-able N-central 2026.4.1 HF2, Enabling Root and SYSTEM RCE
ler a análise desta fonte ocultar
N-able is investigating newly disclosed vulnerabilities named 4EverAble2Shell and Agent2Shell affecting on-premise N-central version 2026.4.1 HF2. The primary risk arises when the Legacy API feature—disabled by default—is enabled and exposed to the public internet. 4EverAble2Shell allows unauthenticated remote code execution with root privileges on N-central servers, while Agent2Shell exploits multiple zero-day flaws to execute commands as SYSTEM on managed Windows agents if the attacker knows the appliance ID. These exploits bypass the recent patch 2026.4.1.26 released November 10, 2026, for the earlier Able2Shell vulnerabilities. Active probing has been observed from IP 157.20.241.16 leveraging also the high-severity CVE-2026-90436 Apache Axis vulnerability as an initial access vector. Hosted N-central environments are not affected. Immediate disablement of Legacy API is strongly advised by N-able.