N-central: 4EverAble2Shell exploited in the wild, even on HF2-patched servers

What happened

On 9 November 2026 researcher Sean Bales published a GitHub repository called Able2Shell with 33 vulnerabilities in N-able N-central, a remote monitoring and management (RMM) platform used mainly by managed service providers (MSPs). Most entries come with a working Python proof of concept. The repository says the flaws were unpatched when posted and mentions no vendor notification and no CVE IDs.

The same day N-able took its hosted N-central environments offline as a precaution and told on-premises customers to keep their servers offline until N-able confirms they can be brought back. According to N-able's statement quoted by Huntress, it had seen no active exploitation as of 9 November, 15:15 UTC and was working on a hotfix.

Update 12 November: on 10 November N-able released N-central 2026.4 HF2 (build 2026.4.1.26) with seven CVEs, and its 11 November blog post says the hotfix resolves every vulnerability exploitable without authentication. The remaining issues generally require an authenticated account, often with elevated privileges, and will be fixed in later hotfixes (no date given). Hosted servers are back online after the upgrade. N-able is observing scanning activity tied to the public proof-of-concept code but has seen no compromise of hosted servers.

4EverAble2Shell: exploited even against HF2 (12 November)

At 03:58 UTC on 12 November the researcher published two more chains: 4EverAble2Shell for the N-central server and Agent2Shell for Windows agents and probes. Both are claimed to work against HF2 (2026.4.1.26), and there is no fix yet.

• How it works (defender's view): the N-central server bundles the old Apache Axis 1.x library. According to CVE-2026-90436 (NVD, CVSS 9.8, published 6 November), Axis instantiates an attacker-chosen class while parsing an inbound SOAP fault, before any authentication handler runs. The result is code execution as the nable account without logging in. A second, still unpatched flaw in N-central's privileged helper tools then gives root. Axis 1.x is end-of-life and no fixed release is planned.
• Precondition: N-able, as quoted by Huntress, says the chain needs the Legacy API enabled and reachable from the internet. It is off by default. The exploit's author confirmed this in the repository at 07:48 UTC. N-able says hosted environments are not vulnerable, and it has disabled the Intune integration as a precaution.
• Exploitation: huntback says the first checks hit its decoys at 08:30 UTC from 157.20.241[.]16, and the first attack that installed a miner came at 09:16 UTC. At 12:50 UTC a public mining pool showed 21 active rigs named after the IPs of compromised N-central servers, 19 of them reporting build 2026.4.1.26 (HF2). Previdian recorded full-chain attempts against its decoy.
• Agent2Shell: the researcher claims SYSTEM-level code execution on Windows agents. No one has reported exploitation yet, and Huntress has not yet confirmed whether this chain also depends on the Legacy API.

Only 4EverAble2Shell is confirmed as exploited so far. The attackers are installing miners for now, but root on a server that manages client endpoints allows far worse. Treat any hit as a full compromise of the server.

Technical details

The repository groups the findings into several classes. Some entries are chains or variants of others, so there are fewer distinct root causes than 33:

• Remote code execution as the nable service user, both without and with authentication, and as root through privileged helper components.
• Privilege escalation from nable to root via writable configuration or script directories, and from technician to administrator.
• XML external entity (XXE) injection, including pre-auth variants.
• Path traversal and arbitrary file write in upload, repository and restore functions.
• Broken access control: anonymous access to protected operations and access across customers or appliances.
• Information disclosure: registration tokens, database credentials and reusable agent credentials in plaintext.

Flaws fixed in HF2, per N-able's release notes and the NVD records (CVSS 4.0 scores from N-able; NVD hasn't added its own assessment yet):

N-able credits CVE-2026-125882 to Nate Fair of Sprocket Security. HF2 also hardens authentication and permission checks, removes legacy mobile device management (MDM) and updates the OS and third-party components.

We don't reproduce exploitation steps. What matters for defenders is what a compromised server can do next:

Who is affected

• On-premises N-central servers running anything before 2026.4.1.26 (HF2). Supported upgrade paths to HF2 are from 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 and 2026.4 (including HF1); older versions must first be upgraded to one of those.
• Hosted N-central customers – N-able upgraded the servers, but you must update your agents and probes yourself.
• Clients of MSPs using N-central – indirectly, because their devices run N-central agents.

N-central has a rough 2026: authentication bypass CVE-2026-18577 went into CISA's KEV catalog on 3 August and pre-auth RCE CVE-2026-86218 on 8 September, both as actively exploited.

How to tell if you were compromised

4EverAble2Shell indicators (huntback, 12 November 2026): defanged, ready to paste into blocklists and log searches. Our IOC extractor can pull them out too.

# Network
157.20.241[.]16            # checks, payloads (port 8080), callbacks (TCP 19202–19418)
139.99.69[.]109:10128      # mining pool (primary)
79.76.51[.]56:39100        # mining pool (fallback)
hxxp://157.20.241[.]16:8080/jup.sh

# Request in the N-central web server log
POST /dms/services/ServerUI  (SOAP fault with an exceptionName element naming jline.internal.TerminalLineSettings)
User-Agent: python-requests/2.31.0

# Files and persistence
/tmp/.xvd/   /var/tmp/.xvd/   (files x, keep.sh, xm.log)
/etc/systemd/system/xvd.service
/etc/cron.d/xvd              # entries tagged "# xvkeep"
/var/opt/n-central/tmp/serverchild-*.sh|.bak|.out
/var/opt/n-central/flag/flag_default.json   # suspicious if it is a symlink

# Processes
command line containing "--rig-id nc_" or "--donate-level 1", binary "x" running from .xvd

# SHA-256 of the privilege escalation script
fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747

For the original Able2Shell flaws, neither N-able nor the researcher has published indicators of compromise (the 11 November HF2 post has none either). N-able says determining whether a specific environment was compromised requires assessing that environment, and it is working directly with customers who have concerns. Huntress and Field Effect recommend checking:

• Logins and authentication to N-central from 8 November onward, especially from unfamiliar addresses.
• New administrator accounts, privilege changes and configuration edits.
• Newly deployed scripts, software and automation policies, and unexpected remote-control sessions.
• Managed endpoints for scripts or installs that originated from N-central and that nobody on your team ordered.

If you find anything suspicious, start incident response and rotate N-central admin, service and integration credentials. Once a vendor or CERT publishes indicators, you can pull them out of the advisory with our IOC extractor.

What to do

1. Disable the Legacy API now (N-able's knowledge base has the steps) and restrict access to the server to admin networks. HF2 alone does not stop 4EverAble2Shell. Hunt for the indicators above, and if you find a hit, treat the server as compromised (isolate, investigate, rebuild, rotate every stored credential).
2. Upgrade on-premises servers to N-central 2026.4 HF2 (2026.4.1.26). N-able says to keep them inaccessible from the internet until the upgrade is complete.
3. Update agents, then probes (hosted and on-prem). A probe upgraded before its agents stops talking to them. Built-in remote control is temporarily disabled in HF2; Take Control still works.
4. Don't leave the management interface open to the whole internet; allow only admin networks.
5. Review activity as described above, starting 8 November.
6. Map what N-central can reach – stored credentials, service accounts, API integrations, domain controllers, backups – and plan rotation.
7. Watch for the follow-up hotfixes covering the remaining authenticated flaws and apply them as soon as they ship.

Timeline

Updates

• 12 November 2026 (evening) – a new chain, 4EverAble2Shell, works against HF2 when the Legacy API is enabled and has been exploited since 12 November to install miners (huntback: 21 servers, 19 on HF2). Added a section on the chain, indicators, a Legacy API step, timeline entries, the at-a-glance box and the headline.
• 12 November 2026 – N-able released N-central 2026.4 HF2 (2026.4.1.26) on 10 November with 7 CVEs (highest CVSS 4.0 9.3) and said on 11 November that every flaw exploitable without authentication is fixed; hosted servers are back online. N-able is seeing scanning based on the public exploits. Added CVEs, the fix table, agent and probe upgrades and new steps.
• 10 November 2026 – first version of this article.