Researcher discloses new N-central flaws enabling root access

N-able said on 12 November 2026 that a new public disclosure alleges additional vulnerabilities in on‑premise versions of N‑central running version 2026.4.1 HF2. The company explained that the server issue described relies on a non-default configuration in which the Legacy API is turned on and exposed to the public internet; Legacy API is turned off by default and not recommended. Hosted environments are not affected. The incident affects N‑central On‑premise in Americas, APAC and Europe regions.

This development comes days after N‑able released 2026.4.1.26 to address a number of security flaws disclosed earlier in the week by independent researcher Sean Bales, collectively tracked as Able2Shell.

The new flaws, named 4EverAble2Shell and Agent2Shell, were disclosed by Bales and are said to enable unauthenticated remote code execution with root privileges on N‑central servers, and to allow commands on managed Windows agents as NT AUTHORITY\\SYSTEM when the attacker knows the target appliance ID.

Observed threat activity, via Previdian telemetry, indicates probing for 4EverAble2Shell within hours of the PoC release, with initial code execution chain including a recently disclosed Apache Axis flaw, CVE-2026-90436 (CVSS 9.8), followed by privilege escalation to root and the download/execution of a shell script from an IP in the 157.20.241.x range using curl.

4EverAble2Shell exploitation attempts have been observed by watchTowr, targeting builds with Legacy API enabled; as of writing there is no confirmed successful exploitation.