Attackers compromised at least 21 N-able N-central servers within hours of a researcher publishing proof-of-concept exploits for two new zero-days, and 19 of those servers had already installed the latest patch. N-able said on November 13 that it had identified additional indicators of compromise and was working with specific customers.
How the 4EverAble2Shell and Agent2Shell PoCs Surfaced
On November 12, researcher Sean Bales published exploits for two flaw sets named 4EverAble2Shell and Agent2Shell. He tested them against N-central 2026.4 HF2, build 2026.4.1.26, the release N-able shipped on November 10 to fix the earlier Able2Shell vulnerabilities.
Bales says he has not made a responsible disclosure to the vendor. N-able disputes claims that it ignored earlier disclosures, and reports indicate two unrelated remote code execution flaws in another N-able product have remained unpatched since July.
4EverAble2Shell: Unauthenticated Root Code Execution
4EverAble2Shell gives an unauthenticated remote attacker root code execution, but only on servers that have the Legacy API enabled and are exposed to the internet. It chains Apache Axis flaw CVE-2026-90436, which carries a CVSS score of 9.8 and was patched on November 6, with a privilege escalation inside N-central.
Agent2Shell: SYSTEM Access on Managed Windows Agents
Agent2Shell relies on roughly a dozen zero-days to run commands on managed Windows agents as NT AUTHORITYSYSTEM. The attacker needs to know the appliance ID. Because N-central pushes work to every endpoint it manages, command execution at the agent layer reaches beyond the server itself.
Exploitation Within Hours and a Cryptominer Payload
Previdian detected probing within hours from the address 157.20.241[.]16, and watchTowr also saw probe traffic. Lupovis and Huntback observed successful compromises about five hours after the PoC went public.
The attackers deployed an XMRig Monero miner, set to use half of a host’s CPU cores, and established persistence through systemd or cron using a script named jup.sh.
Victim Count and the Failure of Hotfix 2
Huntback counted at least 21 compromised N-central servers: nine in the United States, four each in South Africa and Canada, and others in the UK, Germany, France and Sweden. Nineteen of the 21 had applied HF2, which means the patch from earlier in the week offered no protection against the new exploit chains.
Huntback warns that any hit should be treated as a full root compromise of a host that manages customers’ endpoints. Cryptomining is the payload seen so far, but root on a remote monitoring and management server is the same access a ransomware affiliate would want.
N-able’s Shifting Position and Mitigations
N-able’s first advisory said it had seen no sign of compromise. Its November 13 update changed that, reporting additional indicators of compromise and ongoing work with affected customers.
The company disabled the Legacy API and the Intune integration, restricted features on hosted environments, and urged on-premises customers to disable the Legacy API and upgrade Agents and Probes. N-able said further remediation is in development.
An Escalation From the Able2Shell Disclosure
The sequence began on November 9, when the original Able2Shell disclosure listed 33 flaws and N-able took its hosted N-central offline. HF2 followed on November 10 with fixes for seven CVEs. Within two days, the new PoC showed those fixes did not close the underlying attack surface.
For managed service providers, the episode shows how one platform compromise spreads to many downstream customers. A server that manages endpoints for dozens of clients is a single point of failure, and the quick pivot from published code to confirmed exploitation, measured in hours, leaves no realistic window for staged patch testing. Until N-able ships a fix, disabling the Legacy API and removing internet exposure are the controls the vendor itself recommends.
