New N-central PoCs bypass the November patch for root and SYSTEM access
Original title: New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
4EverAble2Shell and Agent2Shell hit on-prem 2026.4.1 HF2 when Legacy API is public; hosted N-central is unaffected.
Researcher Sean Bales published proof-of-concept exploits, dubbed 4EverAble2Shell and Agent2Shell, that he says work against on-premise N-central 2026.4 Hotfix 2 (build 2026.4.1.26), released November 10 to fix Able2Shell. N-able says the server issue depends on the non-default Legacy API being enabled and exposed to the internet and is urging customers to disable it. Hosted environments are not affected. Previdian reports probing from 157.20.241[.]16, including attempts via Apache Axis CVE-2026-90436, but no confirmed successful exploitation.
Unconfirmed: Probing was observed within hours of the PoC, but there is no evidence of successful exploitation as of the report.
- 4EverAble2Shell is described as unauthenticated remote code execution as root on the server.
- Agent2Shell uses more than 10 zero-days to run commands on Windows agents as NT AUTHORITY\SYSTEM if the appliance ID is known.
- Affected services are on-premise N-central in the Americas, APAC and Europe.
- watchTowr also reports probes against builds with Legacy API enabled.
- Dewhurst called the activity the first documented exploitation attempts against CVE-2026-90436, patched November 6.
Impact: Unauthenticated root RCE on servers and SYSTEM access on Windows agents
| Product | Affected | Fixed in |
|---|---|---|
| N-able N-central on-premise | 2026.4.1 HF2 (build 2026.4.1.26) with Legacy API exposed | — |
| Apache Axis | — | patches released November 6, 2026 |
- 1.Disable Legacy API immediately on on-premise N-central if it is enabled.
- 2.Do not expose Legacy API to the public internet.
- CVEs
- CVE-2026-90436
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1105 Ingress Tool Transfer
- Products
- N-centralApache Axis
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90436 | Unauthenticated RCE in Apache Axis 1.x via SOAP fault | 9.8 | <1% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 157.20.241.16 | ble2Shell and then download and execute a shell script from 157.20.241[.]16 using curl. Dewhurst said the development marks the first |
From the original article
2 min read at thehackernews.com
N-able on Thursday said it's investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026. 4. 1 HF2.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.