thehackernews.com
Nov 12, 2026
New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
AI-summarised brief · reviewed before publication
N‑able announced an investigation into a new public disclosure that exposes additional vulnerabilities in its on‑premise N‑central version 2026.4.1 HF2. The flaw requires the Legacy API to be enabled and publicly exposed, a non‑default setting. Researchers Sean Bales identified two new exploits, 4EverAble2Shell and Agent2Shell, which allow unauthenticated root‑level remote code execution and SYSTEM‑level command execution on Windows agents. N‑able urged customers to disable the Legacy API immediately; hosted environments remain unaffected. The incidents follow a recent patch (2026.4.1.26) that addressed earlier Able2Shell flaws.
💡 Why It Matters
- · The attacks demonstrate that even recently patched systems can be compromised if legacy features are misconfigured, underscoring the need for strict access controls.
- · The exploitation attempts also reveal a coordinated chain that leverages newly disclosed CVEs, highlighting the evolving threat landscape for managed‑services platforms.
