N-able N-central HF2 still exposed to new unauthenticated root exploit code
Original title: New N-able N-central Zero-Day Exploits Target Patched Servers, Claiming Unauthenticated Root Access
Huntress says 4EverAble2Shell and Agent2Shell target build 2026.4.1.26, with no fix and no confirmed customer attacks.
Exploit code published late on November 11 reportedly hits N-able N-central 2026.4 HF2, build 2026.4.1.26, days after N-able’s November 10 emergency hotfix. A researcher claims 4EverAble2Shell yields unauthenticated root remote code execution when Legacy API mode is enabled. Huntress’s code review supports that chain and describes Agent2Shell issues that could run commands as SYSTEM on managed Windows devices, but says no fix was available and successful customer attacks were not established.
Unconfirmed: Huntress supports the claimed chains from code review but has not established successful attacks on customer servers.
- The tools are named 4EverAble2Shell and Agent2Shell.
- Agent2Shell claims require knowledge of the appliance ID.
- Huntress describes more than ten issues, including two unauthenticated command chains.
- On-premises customers were told to take N-central offline or remove internet access.
- Indicators came from static review and had not been seen in real attacks.
Impact: unauthenticated root RCE and SYSTEM commands on managed Windows devices
| Product | Affected |
|---|---|
| N-able N-central | 2026.4 HF2, build 2026.4.1.26 |
- 1.Take on-premises N-central offline or remove internet access even after HF2.
- 2.Review logs for unusual requests to /dms/services/ServerUI and /dms2/services2/ServerMMS2 using session ID -1.
- 3.From November 11, check unexpected accounts, scripts, tasks, encoded PowerShell, and service restarts.
- Vendors
- N-able
- Products
- N-central
- Malware
- 4EverAble2ShellAgent2Shell
- Organizations
- Huntress
From the original article
2 min read at cybersecuritynews.com
New exploit code for N-able N-central has raised fresh concerns after researchers reported that servers running the latest emergency hotfix remain exposed. Published late on November 11, the tools, named 4EverAble2Shell and Agent2Shell, reportedly target N-central 2026. 4 HF2, build 2026.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.