Ethical Hacking News
New N-central Exploits Enable Root RCE and Windows SYSTEM Access
N-central, a managed services and cybersecurity solution provider, has been affected by new vulnerabilities in their on-premise versions.The vulnerabilities depend on a non-default configuration, where the Legacy API is turned on and exposed to the public internet.N-able has urged customers to disable the Legacy API immediately to prevent potential exploitation.Hosted environments are not affected by this issue.Two new shortcoming have been codenamed 4EverAble2Shell and Agent2Shell, which have been found to work against N-central 2026.4 Hotfix 2.The 4EverAble2Shell exploit enables unauthenticated remote code execution with root privileges, while the Agent2Shell exploit leverages zero-day vulnerabilities to run commands on managed Windows agents.Targeted probing has been observed against 4EverAble2Shell within hours of its release, but no successful exploitation has been confirmed.The incident highlights the importance of staying up to date with the latest security patches and taking proactive measures to protect against emerging threats.The incident emphasizes the need for responsible disclosure and timely reporting of vulnerabilities to vendors.
New N-central, a leading provider of managed services and cybersecurity solutions, has been affected by a new public disclosure that highlights additional vulnerabilities in their on-premise versions, specifically running version 2026.4.1 HF2. According to the company's investigation, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet. This is contrary to the company's default setting, where the Legacy API is disabled and not recommended for use.
N-able, the company behind N-central, has urged customers to disable the Legacy API immediately, if not already, to prevent potential exploitation. However, it's worth noting that hosted environments are not affected by this issue. The incident highlights the importance of regularly updating and patching software to prevent vulnerabilities in cybersecurity solutions.
The vulnerabilities collectively tracked under the name Able2Shell have been further revealed, and two new shortcoming have been codenamed 4EverAble2Shell and Agent2Shell. These exploits have been found to work against N-central 2026.4 Hotfix 2 (build 2026.4.1.26), the update N-able released on November 10, 2026, to resolve Able2Shell. The 4EverAble2Shell exploit enables unauthenticated remote code execution with root privileges on N-central servers, while the Agent2Shell exploit leverages more than 10 zero-day vulnerabilities to run commands on managed Windows agents as NT AUTHORITY\SYSTEM, assuming the attacker knows the target appliance ID.
Ryan Dewhurst, founder and CEO of Previdian, told The Hacker News that targeted N-central probing has been observed against 4EverAble2Shell within hours following the release of the PoC. The activity has originated from the IP address 157.20.241[.]16. There is no evidence of successful exploitation as of writing. However, the development marks the first documented instance of exploitation attempts aimed at CVE-2026-90436, patches for which were released on November 6, 2026.
In a post shared on X, watchTowr also said it's seeing probes for 4EverAble2Shell targeting N-Centrals builds with the Legacy API enabled. The incident highlights the importance of keeping software up to date and disabling unnecessary features to prevent potential security breaches.
The development comes days after N-able released 2026.4.1.26 to address a number of security flaws disclosed by independent security researcher Sean Bales earlier this week. The vulnerabilities are collectively tracked under the name Able2Shell, and the new shortcoming have been codenamed 4EverAble2Shell and Agent2Shell.
According to the researcher, 4EverAble2Shell enables unauthenticated remote code execution with root privileges on N-central servers. Agent2Shell, on the other hand, leverages more than 10 zero-day vulnerabilities to run commands on managed Windows agents as NT AUTHORITY\SYSTEM, assuming the attacker knows the target appliance ID.
The incident is a reminder that cybersecurity solutions are not immune to vulnerabilities and that regular updates and patching are essential to prevent exploitation. N-able's prompt response to the incident and their recommendations for customers to disable the Legacy API immediately demonstrate their commitment to security and customer protection.
In a rapidly evolving cybersecurity landscape, it's essential for organizations to stay informed and take proactive measures to protect themselves against emerging threats. The incident highlights the importance of staying vigilant and taking immediate action to address potential security breaches.
The incident also underscores the importance of responsible disclosure and the need for security researchers to report vulnerabilities to vendors in a timely and coordinated manner. The fact that the vulnerabilities were disclosed publicly and the exploits were observed being used in the wild highlights the importance of transparency and cooperation between security researchers, vendors, and customers.
In conclusion, the recent incident affecting N-central highlights the importance of staying up to date with the latest security patches and taking proactive measures to protect against emerging threats. The incident serves as a reminder that cybersecurity solutions are not immune to vulnerabilities and that regular updates and patching are essential to prevent exploitation.
Related Information:
https://www.ethicalhackingnews.com/articles/New-N-central-Exploits-Enable-Root-RCE-and-Windows-SYSTEM-Access-ehn.shtml
https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html
Published: Thu Nov 12 08:31:10 2026 by llama3.2 3B Q4_K_M
