New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access Ravie LakshmananNov 12, 2026Vulnerability / Cyber Attack N-able on Thursday said it's investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1 HF2. "Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet," N-able said in a new advisory. "Legacy API is turned off by default in the product and is not recommended." The company is urging customers to disable Legacy API immediately, if not already. It also noted that hosted environments are not affected by this issue. The incident impacts the following services - The development comes days after N-able released 2026.4.1.26 to address a number of security flaws disclosed by independent security researcher Sean Bales earlier this week. The vulnerabilities are collectively tracked under the name Able2Shell. The new shortcoming, also revealed by Bales, have been codenamed 4EverAble2Shell and Agent2Shell, adding the proof-of-concept (PoC) exploits successfully work against N-central 2026.4 Hotfix 2 (build 2026.4.1.26), the update N-able released on November 10, 2026, to resolve Able2Shell. According to the researcher, 4EverAble2Shell enables unauthenticated remote code execution with root privileges on N-central servers. Agent2Shell, on the other hand, leverages more than 10 zero-day vulnerabilities to run commands on managed Windows agents as NT AUTHORITY\SYSTEM, assuming the attacker knows the target appliance ID. Ryan Dewhurst, founder and CEO of Previdian, told The Hacker News that targeted N-central probing has been observed against 4EverAble2Shell within hours following the release of the PoC. The activity has originated from the IP address 157.20.241[.]16. There is no evidence of successful exploitation as of writing. In the attack chain observed by the threat intelligence company, threat actors have been observed attempting to achieve initial code execution through a recently disclosed Apache Axis flaw (CVE-2026-90436, CVSS score: 9.8), followed by attempts to escalate privileges to root using 4EverAble2Shell, and then download and execute a shell script from 157.20.241[.]16 using curl. Dewhurst said the development marks the first documented instance of exploitation attempts aimed at CVE-2026-90436, patches for which were released on November 6, 2026. In a post shared on X, watchTowr also said it's seeing probes for 4EverAble2Shell targeting N-Central builds with the Legacy API enabled. (This is a developing story. Please check back for more information.) Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, endpoint security, remote code execution, Vulnerability Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux The Flood is Coming And The Pipes Were Already Full The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Session Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk