N-able is investigating reports of additional security vulnerabilities affecting on-premises installations of its N-central platform, after a security researcher disclosed new proof-of-concept exploits that reportedly remain effective even against systems running the latest security updates.
The newly identified vulnerabilities affect N-central version 2026.4.1 HF2, particularly installations where the Legacy API feature is enabled and accessible from the public internet.
In an advisory released on Thursday, N-able said its preliminary investigation indicated that the reported server-side vulnerability depends on a non-default configuration involving the Legacy API.
The company explained that the Legacy API is disabled by default and is not recommended for use.
N-able has urged customers to immediately disable the feature if it is currently enabled. It also clarified that its hosted environments are not affected by the reported issue.
The incident affects the following on-premises service regions:
-
N-central On-premise (Americas)
-
N-central On-premise (Asia-Pacific)
-
N-central On-premise (Europe)
The disclosure comes just days after N-able released version 2026.4.1.26 on November 10, 2026, to address several security vulnerabilities identified by independent researcher Sean Bales.
Those earlier vulnerabilities were collectively named Able2Shell and prompted security concerns surrounding the N-central platform.
However, Bales has now disclosed two additional exploit chains, named 4EverAble2Shell and Agent2Shell, claiming that both can successfully compromise systems running N-central 2026.4 Hotfix 2, build 2026.4.1.26.
This means the newly released security update intended to address Able2Shell does not prevent the two additional proof-of-concept exploits from working, according to the researcher.
Two New Exploits Target N-central Systems
According to Bales, 4EverAble2Shell can enable unauthenticated remote code execution with root-level privileges on vulnerable N-central servers.
The second exploit, Agent2Shell, uses more than 10 previously undisclosed vulnerabilities to execute commands on Windows devices managed through N-central.
Successful exploitation could allow attackers to run commands under the highly privileged Windows security account NT AUTHORITY\SYSTEM.
However, the Agent2Shell attack requires the attacker to know the appliance ID associated with the targeted N-central installation.
The disclosures have raised concerns because N-central is used by managed service providers and IT administrators to remotely monitor and manage customer infrastructure, making successful exploitation potentially significant for organisations relying on the platform.
Security Researchers Report Targeted Probing
Ryan Dewhurst, founder and chief executive officer of cybersecurity company Previdian, told The Hacker News that his organisation observed targeted attempts to probe N-central systems for the 4EverAble2Shell vulnerability within hours of the proof-of-concept exploit becoming public.
The activity reportedly originated from IP address 157.20.241[.]16.
However, Dewhurst said there was no evidence of successful exploitation at the time of reporting.
Previdian’s investigation identified an attempted attack sequence involving several stages.
The threat actors first attempted to gain initial code execution by exploiting a recently disclosed Apache Axis vulnerability, tracked as CVE-2026-90436, which carries a CVSS severity score of 9.8.
After attempting to establish an initial foothold, the attackers reportedly tried to escalate their privileges to root using 4EverAble2Shell.
The final stage involved attempts to download and execute a shell script hosted on the same IP address, 157.20.241[.]16, using the curl command-line utility.
Dewhurst described the activity as the first documented instance of exploitation attempts targeting CVE-2026-90436. Security patches for the Apache Axis vulnerability were released on November 6, 2026.
The findings suggest that attackers may be combining vulnerabilities in different software products to establish access, escalate privileges and deploy additional malicious commands.
Cybersecurity firm watchTowr also disclosed that it had observed probing activity targeting N-central installations vulnerable to 4EverAble2Shell.
In a post on X, the company said the activity involved attempts to identify N-central builds where the Legacy API feature remained enabled.
N-able Urges Customers to Disable Legacy API
N-able’s immediate recommendation is for customers operating affected on-premises installations to disable the Legacy API, particularly where the interface is exposed to the public internet.
The company said the feature is disabled by default and is not recommended.
Although its investigation is ongoing, the advisory indicates that the reported server vulnerability depends on this specific configuration.
Organisations using N-central should therefore review their installations, confirm whether the Legacy API is enabled and restrict unnecessary exposure while awaiting further security guidance.
The latest disclosures also demonstrate that applying a security update does not necessarily eliminate every vulnerability affecting a software platform, particularly when additional weaknesses are discovered after the initial patches have been released.
N-able’s investigation and the reported probing activity remain ongoing.