Hunt: N-central 4EverAble2Shell / Agent2Shell, SessionID -1 SOAP calls, a flag_default.json symlink and CodeDrop files on probes

vendor research (Huntress static analysis of the public PoC, Nov 12, 2026; Huntress says none seen in the wild yet); probing IP from Previdian via The Hacker News2026-11-12 7:40 AM ET

Hunt: N-central 4EverAble2Shell / Agent2Shell, SessionID -1 SOAP calls, a flag_default.json symlink and CodeDrop files on probes

Server web logs: POSTs to /dms/services/ServerUI containing jline.internal.TerminalLineSettings (the PoC gets HTTP 500), or GenericAgentXMPPMessageExchange with SessionID -1; POSTs to /dms2/services2/ServerMMS2 containing RemoteExecutionTaskSubmit with sessionID -1.
Server files: /var/opt/n-central/flag/flag_default.json as a symlink to /opt/nable/var/ncsai/scripts/ServerChild.sh; /var/opt/n-central/tmp/serverchild-<12 hex>.bak, .sh or .out; ZIPs under /download/scheduled_tasks/output_files/ containing CodeDropMeta.xml.
Windows endpoints: powershell.exe -NoProfile -NonInteractive -EncodedCommand as SYSTEM spawned by the N-able Agent (PowerShell under the Agent is normal; decode the command); wsp.exe or service.cfg written to Windows Software Probe\bin with a backup at CodeDrop\ServiceBackup\wsp.exe and files in Temp\CodeDropTmp; taskkill /f /im wsp.exe and a stop/start of the Windows Software Probe Service from a .cmd in %TEMP%.
Network: inbound from, and curl downloads from, 157.20.241[.]16 (Previdian); SOAP faults that name arbitrary classes (Apache Axis CVE-2026-90436 attempts).

Sources: Huntress: N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains (updated Nov 12, 1:10 AM and 6:30 AM ET) · The Hacker News: New N-central Exploits Work Against Patched Servers (Nov 12, 2026; quotes N-able's advisory and Previdian)