Another N-able Vulnerability Emerges

The security situation surrounding N-able’s N-central platform is continuing to evolve. Just days after the release of N-central 2026.4 Hotfix 2, which was intended to resolve the “Able2Shell” zero-day suite, a researcher has disclosed a new set of exploits—dubbed “4EverAble2Shell” and “Agent2Shell”—that work against the previously patched build and threat intelligence teams have already seen some limited exploit attempts in the wild.

This new development has put on-premise administrators under renewed pressure, as the new exploits effectively bypass the protections implemented just 48 hours prior. N-able said it is aware of the new disclosure and is looking into it. 

“N-able is investigating a new public disclosure containing claims of additional vulnerabilities in N-central On-Premises 2026.4.1 HF2. Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet. Legacy API is turned off by default in the product and is not recommended.” the company’s advisory says.

The technical impact of these new findings is significant. The 4EverAble2Shell vulnerability enables unauthenticated remote code execution with root privileges on the server. Meanwhile, Agent2Shell leverages more than 10 zero-day vulnerabilities to grant an attacker NT AUTHORITY\SYSTEM access on managed Windows agents, provided the attacker knows the target appliance ID. Security firm Previdian reports that targeted probing for 4EverAble2Shell began within hours of the public disclosure, originating from the IP address 157.20.241.16.

“Within five hours of the initial 4EverAble2Shell PoC commit, probing has reached one of our N-central honeypot decoys,” Previdian said.

Researchers at watchTowr also reported seeing attackers probing for the new N-able flaw.

N-able says that the primary attack vector for these new exploits relies on a specific, non-default configuration where the “Legacy API” is enabled and exposed to the public internet. Because the Legacy API is disabled by default and is not recommended for production use, hosted environments remain unaffected. However, on-premise customers are at risk if their current configuration deviates from these security best practices.

Threat intelligence indicates that adversaries are utilizing a sophisticated multi-stage attack chain. This process often begins with the exploitation of a previously patched Apache Axis flaw (CVE-2026-90436), serving as the initial entry point. Once the foothold is established, attackers can utilize 4EverAble2Shell to escalate privileges to root, using curl to download and execute malicious scripts. This is the first documented instance of active exploitation attempts aimed at CVE-2026-90436 since the patch for that vulnerability was released on Nov. 6.

This new disclosure follows a turbulent week that began on Nov. 9 with the initial disclosure of 33 zero-day vulnerabilities, including CVE-2026-125883 and CVE-2026-125878. As the situation evolves, N-able is urging customers to verify that the Legacy API is disabled immediately. 

N-able said that hosted environments aren’t affected by the new bug. 

“Our Security and Engineering teams are assessing the claims, including which versions may be in scope,” the advisory says.