{"id":4151,"date":"2026-11-12T15:16:53","date_gmt":"2026-11-12T15:16:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4151"},"modified":"2026-11-12T15:16:53","modified_gmt":"2026-11-12T15:16:53","slug":"new-n-central-exploits-work-against-patched-servers-enable-root-rce-and-windows-system-access","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4151","title":{"rendered":"New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Nov 12, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Cyber Attack<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhR4KdRS0v77uQIdhC0i5aopa8XIAZIRnTzVCVqto7dEdfUH2QyWgrAy1EKu-hARXS4pxNGQQEFroRHOtwSq_9Q8b92tmgw_97JMJoBfC72sl8pOcUYM9nU6YCJht4yD7ALWfERwhUwLsN8wo9t8YnKyIWzHhEAux5ox5WV4wvxe6l1cUmf58P1md2Ekziy\/s1700-nu-rw-lo-l85-e365\/nable.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>N-able on Thursday said it&#8217;s investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1 HF2.<\/p>\n<p>\u00abBased on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet,\u00bb N-able <a href=\"https:\/\/uptime.n-able.com\/event\/202609\/\" target=\"_blank\">said<\/a> in a new advisory. \u00abLegacy API is turned off by default in the product and is not recommended.\u00bb<\/p>\n<p>The company is urging customers to disable Legacy API immediately, if not already. It also noted that hosted environments are not affected by this issue.<\/p>\n<p>The incident impacts the following services &#8211;<\/p>\n<ul>\n<li>N-central On-premise (Americas)<\/li>\n<li>N-central On-premise (APAC)<\/li>\n<li>N-central On-premise (Europe)<\/li>\n<\/ul>\n<p>The development comes days after N-able <a href=\"https:\/\/uptime.n-able.com\/event\/202584\/\" target=\"_blank\">released<\/a> 2026.4.1.26 to <a href=\"https:\/\/status.n-able.com\/2026\/11\/10\/n-central-2026-4-hf2-release-notes\/\" target=\"_blank\">address<\/a> a number of security flaws disclosed by independent security researcher Sean Bales earlier this week. The vulnerabilities are collectively tracked under the name Able2Shell.<\/p>\n<p>The new shortcoming, also <a href=\"https:\/\/github.com\/MSPNightmare\/CVEs\/tree\/main\/0-Days\/N-Central%20N-Able\" target=\"_blank\">revealed<\/a> by Bales, have been codenamed <strong>4EverAble2Shell<\/strong> and <strong>Agent2Shell<\/strong>, adding the proof-of-concept (PoC) exploits successfully work against N-central 2026.4 Hotfix 2 (build 2026.4.1.26), the update N-able released on November 10, 2026, to resolve Able2Shell.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-governance-platform-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi9hjzSN2bSutSbaNO6ZWEm02wC6hue03kC4VKPSfsdPvcDX2PAvPE-u9QrLCw3POvN3hXFPlyYyFgkAgtKrs4I2oSb9BkIFOWQ_k1ISfIBdT2AoWNvq2Q2DF_3AyA4fJriKPHkTjqYFxu-Y_H4IH9uqscX8lh-puQ5cPmc_veAEr9p4fC0497XT8Fktlp6\/s728-nu-rw-lo-l85-e365\/tl-insidem-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>According to the <a href=\"https:\/\/x.com\/seankbales\/status\/2120729661017555235\" target=\"_blank\">researcher<\/a>, 4EverAble2Shell enables unauthenticated remote code execution with root privileges on N-central servers. Agent2Shell, on the other hand, leverages more than 10 zero-day vulnerabilities to run commands on managed Windows agents as NT AUTHORITY\\SYSTEM, assuming the attacker knows the target appliance ID.<\/p>\n<p>Ryan Dewhurst, founder and CEO of Previdian, told The Hacker News that targeted N-central probing has been <a href=\"https:\/\/previdian.com\/VULN-2026-0009#telemetry\" target=\"_blank\">observed<\/a> against 4EverAble2Shell within hours following the release of the PoC. The activity has originated from the IP address 157.20.241[.]16. There is no evidence of successful exploitation as of writing.<\/p>\n<p>In the attack chain observed by the threat intelligence company, threat actors have been observed attempting to achieve initial code execution through a recently disclosed Apache Axis flaw (CVE-2026-90436, CVSS score: 9.8), followed by attempts to escalate privileges to root using 4EverAble2Shell, and then download and execute a shell script from 157.20.241[.]16 using curl.<\/p>\n<p>Dewhurst said the development marks the first documented instance of exploitation attempts aimed at CVE-2026-90436, patches for which were released on November 6, 2026.<\/p>\n<p>In a <a href=\"https:\/\/x.com\/watchtowrcyber\/status\/2120803577094439123\" target=\"_blank\">post<\/a> shared on X, watchTowr also said it&#8217;s seeing probes for 4EverAble2Shell targeting N-Centrals builds with the Legacy API enabled.<\/p>\n<p><em>(This is a developing story. Please check back for more information.)<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Nov 12, 2026Vulnerability \/ Cyber Attack N-able on Thursday said it&#8217;s investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1&hellip;<\/p>\n","protected":false},"author":1,"featured_media":4152,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[130,369,430,2848,1707,316,61,777,1045,307,538],"class_list":["post-4151","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-access","tag-enable","tag-exploits","tag-ncentral","tag-patched","tag-rce","tag-root","tag-servers","tag-system","tag-windows","tag-work"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4151"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4151\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/4152"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}