On November 12, 2026, a significant threat emerged against N-able’s N-central on-premise systems: newly disclosed exploits that overcome the latest fixes to deliver root‐level and Windows SYSTEM access. Even servers updated with Hotfix 2 of version 2026.4.1.26 remain vulnerable if a certain legacy feature is misconfigured.
Root RCE & SYSTEM Elevation via Legacy API Exposure
The vulnerabilities, dubbed 4EverAble2Shell and Agent2Shell, were revealed by researcher Sean Bales. Although version 2026.4.1.26 was recently released to patch the earlier Able2Shell flaws, both new sets of exploit paths still succeed in systems with the Legacy API enabled and exposed to the public internet. The Legacy API is meant to be turned off by default and is strongly discouraged for internet-facing access.
4EverAble2Shell allows unauthenticated remote code execution with root privileges on N-central servers. Agent2Shell, however, takes a different angle: it exploits over ten zero-day vulnerabilities to run commands on Windows agents as the NT AUTHORITY\SYSTEM user, provided the attacker knows the target’s appliance ID. Hybrid attack chains involving both exploits have been observed.
Patch Bypass & Real-World Probing
Despite the fixes intended to address Able2Shell, these new flaws bypass those protections on non-default configurations. N-able has issued an advisory urging customers to immediately disable the Legacy API if it hasn’t been already. Hosted instances aren’t impacted.
Security researchers have seen potential exploit attempts kick off within hours of proof-of-concept code being made public. In one observed attack chain, adversaries first exploited a critical Apache Axis vulnerability (CVE-2026-90436, rated 9.8) to gain initial code execution, then escalated privileges via 4EverAble2Shell, followed by attempting to execute a shell script downloaded from a threat actor–controlled IP address. While scans and probes are ongoing, no confirmed successful exploit has been reported so far.
The incidents are active across N-central installations in the Americas, Europe, and APAC regions. Threat actors are particularly targeting those installations where the Legacy API remains enabled despite recent patches. IP-based probing has been traced to an address within 157.20.241[.]16.
N-able’s own advisory clarifies that these new exploits only threaten on-premise customers with the specific configuration, and not users on the hosted platform. It reiterated that the Legacy API is off by default, and that publicly exposing it represents a misconfiguration that exposes N-central servers to serious risk.
In light of these developments, N-central users are encouraged to review configuration settings immediately, ensure the Legacy API is completely disabled, confirm that version 2026.4.1.26 is applied, and isolate administrative access. Security teams should monitor for signs of probing or unusual agent behavior.
Why this matters: Even as vendors release patches, misconfigurations can render cutting-edge fixes moot. These exploits demonstrate how legacy features, if enabled and exposed, act like open doors for root compromise—even on patched systems. Watch how organizations respond: whether disabling the Legacy API stays ignored—and whether these exploits escalate to widespread breaches.
