New N-central exploits work on the Nov 10 hotfix: unauthenticated root RCE if Legacy API is on, plus 'Agent2Shell' SYSTEM commands on managed Windows endpoints; probing has started
- Do now (on-prem): confirm Legacy API is off (N-able has a KB article for disabling it). If you must keep it on, don't expose it to the internet. Huntress no longer advises taking servers offline if Legacy API is disabled.
- Still open: Huntress says it hasn't yet confirmed whether the Agent2Shell chains against Windows Agents and Probes also depend on Legacy API, and there is no fix or CVE for the new chains yet.
- Probing seen: per Previdian (via The Hacker News), attackers tried initial code execution through the Apache Axis 1.x deserialization flaw CVE-2026-90436 (CVSS 9.8, patched in source Nov 6; Axis 1 is EOL), then 4EverAble2Shell to reach root, then pulled a shell script from 157.20.241[.]16 with curl. Previdian says it has no evidence of successful exploitation.
- Keep HF2: it still fixes the seven Able2Shell CVEs from Nov 10; upgrade Agents first, then Probes.
- If Legacy API was enabled and reachable: review server and endpoint activity from Nov 11 on, using the indicators in the hunt item.
Sources: Huntress: N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains (updated Nov 12, 1:10 AM and 6:30 AM ET) · The Hacker News: New N-central Exploits Work Against Patched Servers (Nov 12, 2026; quotes N-able's advisory and Previdian) · watchTowr on X: probes for 4EverAble2Shell on builds with Legacy API enabled (Nov 12, 2026) · Previdian: CVE-2026-90436 exploitation attempts, Apache Axis 1.x (EOL) · N-able status: N-central Critical Security Incident (event 202561)