N-able is currently examining new reports of vulnerabilities in on-premise versions of its N-central software. These flaws, found in version 2026.4.1 HF2, could potentially allow unauthorized access to critical systems. The company highlighted that these vulnerabilities are associated with a non-standard configuration where the Legacy API is exposed online. By default, this API is disabled in the product and its exposure is not advised.
Immediate Actions Recommended
Users are strongly advised to deactivate the Legacy API if it is active. The company assured that hosted environments remain unaffected by the issue. The affected deployments include on-premise versions of N-central in the Americas, Asia-Pacific, and Europe.
This revelation follows the recent release of version 2026.4.1.26, which aimed to fix several security weaknesses identified by independent researcher Sean Bales. These were collectively named Able2Shell. However, new vulnerabilities identified by Bales, codenamed 4EverAble2Shell and Agent2Shell, have emerged. These vulnerabilities are capable of bypassing the latest security patch.
Details of the Exploits
The 4EverAble2Shell exploit enables attackers to execute code with root privileges on N-central servers without authentication. Agent2Shell, on the other hand, exploits over ten zero-day vulnerabilities, allowing command execution on Windows agents as NT AUTHORITYSYSTEM, contingent upon knowledge of the target’s appliance ID.
Within hours of the proof-of-concept release, malicious probing of N-central systems was reported, originating from the IP address 157.20.241[.]16. No confirmed successful exploits have been reported yet, according to Ryan Dewhurst, CEO of Previdian.
Attack Methodology and Observations
Threat actors have been observed attempting initial code execution via a known Apache Axis vulnerability (CVE-2026-90436, CVSS score: 9.8). This is followed by privilege escalation attempts using 4EverAble2Shell, and subsequent downloading and executing of a shell script via curl from the identified IP address.
This incident is noted to be the first recorded attempt to exploit CVE-2026-90436, with patches having been made available on November 6, 2026. Security firm watchTowr has also reported similar probing activities targeting N-central builds with the Legacy API enabled.
This is an evolving situation, and stakeholders are encouraged to monitor updates closely.
