N-central 4EverAble2Shell: HF2 servers exploited, no fix

Call: Patch now, which today means turn off Legacy API, because there’s no patch. It’s being exploited. Two days after N-able shipped N-central 2026.4 HF2 to close the first batch of public exploits, the same researcher published two more chains, 4EverAble2Shell and Agent2Shell, and says both work against HF2. Within hours, attackers were using 4EverAble2Shell to get root on internet-facing N-central servers. Huntback counted 21 compromised servers, and 19 of them were already on HF2. If you patched on Tuesday and called it done, it isn’t done.

What breaks: According to the researcher and the reporting, 4EverAble2Shell is an unauthenticated chain. It uses an Apache Axis bug (CVE-2026-90436, CVSS 9.8) to run commands as the nable service account, then an N-central privilege escalation to get root. It only works when N-central’s Legacy API is turned on. Legacy API is off by default, so you’re exposed if someone turned it on and the server can be reached from the internet. Agent2Shell is a separate set of more than ten bugs in how the server talks to Windows Agents and Probes. Huntress says two of those chains let an attacker who can reach the server run commands as SYSTEM on the Windows machines it manages. We haven’t seen exploitation of Agent2Shell reported.

What’s been seen: Previdian saw probing of its honeypot at about 08:30 UTC on Nov 12 (1:30 AM Mountain), roughly an hour after the proof of concept went up. The full chain was attempted from 09:16 UTC. Huntback and Lupovis tied 21 production N-central servers to the attacker’s mining pool. All of them were running an XMRig Monero miner set to use about half the CPU cores, and they were in the US, Canada, South Africa, the UK, Germany, France and Sweden. The attacker’s download server was 157.20.241[.]16. A miner is the only payload seen so far. As Huntback puts it, the attacker still ends up with root on the box that manages your customers’ endpoints.

What N-able says: N-able turned Legacy API off by default in hosted N-central and switched off the Intune integration while it adds protections. It tells on-prem customers to make sure Legacy API is off and to upgrade Agents and Probes. N-able says it has seen no signs of compromise on hosted servers. On Nov 13 it said it had found more indicators of compromise and is working with “those specific customers.” Its status page says more fixes are being developed. No date yet.

Who’s hit: On-prem N-central with Legacy API turned on and reachable from the internet. That’s 2026.4 HF2 (build 2026.4.1.26) and, as far as anyone can tell, everything before it. N-able says hosted customers don’t need to do anything on the server side.

What to do:

Turn Legacy API off now. If something depends on it, that integration waits until N-able ships a fix.
Keep on-prem N-central off the public internet. HF2 was supposed to let you reconnect. It doesn’t anymore.
Stay on HF2, and finish upgrading Agents and then Probes. HF2 still fixes the first round of bugs.
Check before you clean up. The reporting suggests looking for requests to /dms/services/ServerUI, references to jline.internal.TerminalLineSettings, a process using half the CPU, and outbound traffic to 157.20.241[.]16. If you find any of that, treat it as a full server compromise: preserve evidence, rebuild, and rotate admin, technician and agent-registration credentials.

We’ll update this when N-able ships a fix or confirms more about the scope.

Sources: BleepingComputer (opens in a new tab), Huntress (opens in a new tab), SecurityWeek (opens in a new tab), The Hacker News (opens in a new tab), N-able (opens in a new tab).

N-central 4EverAble2Shell: HF2 servers exploited, no fix

Sources

More from November 2026 patch cycle