---
title: New N-central exploits work on the Nov 10 hotfix: unauthenticated root RCE if Legacy API is on, plus 'Agent2Shell' SYSTEM commands on managed Windows endpoints; probing has started | ctxsec
url: https://ctxsec.com/items/n-able-n-central-4everable2shell-agent2shell-work-on-hf2-legacy-api-probing-nov-12
description: "Late on Nov 11 the researcher behind Able2Shell published two more exploit sets for N-able N-central, 4EverAble2Shell and Agent2Shell, stated to work against 2026.4 HF2 (build 2026.4.1.26), the fix released on Nov 10. Huntress says 4EverAble2Shell is an unauthenticated chain to root on the server, and Agent2Shell is more than ten issues in server-to-Agent/Probe communication, two of which let an unauthenticated attacker who can reach the server run commands on managed Windows endpoints as SYSTEM. N-able's new advisory says the server issue depends on a non-default configuration with Legacy API turned on and exposed to the internet, that hosted N-central is not affected, and that customers should disable Legacy API now; the researcher has since updated the repository to say the chain needs Legacy API. watchTowr says it is seeing probes for 4EverAble2Shell, and Previdian told The Hacker News it saw targeted probing from 157.20.241[.]16 within hours of the PoC."
status: "official (N-able advisory, as quoted by Huntress and The Hacker News, Nov 12, 2026); watchTowr and Previdian report probing; no confirmed successful exploitation; no fix or CVE yet"
published: 2026-11-12
---

> Late on Nov 11 the researcher behind Able2Shell published two more exploit sets for N-able N-central, 4EverAble2Shell and Agent2Shell, stated to work against 2026.4 HF2 (build 2026.4.1.26), the fix released on Nov 10. Huntress says 4EverAble2Shell is an unauthenticated chain to root on the server, and Agent2Shell is more than ten issues in server-to-Agent/Probe communication, two of which let an unauthenticated attacker who can reach the server run commands on managed Windows endpoints as SYSTEM. N-able's new advisory says the server issue depends on a non-default configuration with Legacy API turned on and exposed to the internet, that hosted N-central is not affected, and that customers should disable Legacy API now; the researcher has since updated the repository to say the chain needs Legacy API. watchTowr says it is seeing probes for 4EverAble2Shell, and Previdian told The Hacker News it saw targeted probing from 157.20.241[.]16 within hours of the PoC.

[← Cybersecurity News](/news) · [markdown](/items/n-able-n-central-4everable2shell-agent2shell-work-on-hf2-legacy-api-probing-nov-12.md)

official (N-able advisory, as quoted by Huntress and The Hacker News, Nov 12, 2026); watchTowr and Previdian report probing; no confirmed successful exploitation; no fix or CVE yet

2026-11-12 7:40 AM ET

### New N-central exploits work on the Nov 10 hotfix: unauthenticated root RCE if Legacy API is on, plus 'Agent2Shell' SYSTEM commands on managed Windows endpoints; probing has started

- **Do now (on-prem):** confirm Legacy API is off (N-able has a KB article for disabling it). If you must keep it on, don't expose it to the internet. Huntress no longer advises taking servers offline if Legacy API is disabled.
- **Still open:** Huntress says it hasn't yet confirmed whether the Agent2Shell chains against Windows Agents and Probes also depend on Legacy API, and there is no fix or CVE for the new chains yet.
- **Probing seen:** per Previdian (via The Hacker News), attackers tried initial code execution through the Apache Axis 1.x deserialization flaw CVE-2026-90436 (CVSS 9.8, patched in source Nov 6; Axis 1 is EOL), then 4EverAble2Shell to reach root, then pulled a shell script from 157.20.241[.]16 with curl. Previdian says it has no evidence of successful exploitation.
- **Keep HF2:** it still fixes the seven Able2Shell CVEs from Nov 10; upgrade Agents first, then Probes.
- **If Legacy API was enabled and reachable:** review server and endpoint activity from Nov 11 on, using the indicators in the hunt item.

Sources: [Huntress: N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains (updated Nov 12, 1:10 AM and 6:30 AM ET)](https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains) · [The Hacker News: New N-central Exploits Work Against Patched Servers (Nov 12, 2026; quotes N-able's advisory and Previdian)](https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html) · [watchTowr on X: probes for 4EverAble2Shell on builds with Legacy API enabled (Nov 12, 2026)](https://x.com/watchtowrcyber/status/2120803577094439123) · [Previdian: CVE-2026-90436 exploitation attempts, Apache Axis 1.x (EOL)](https://previdian.com/CVE-2026-90436) · [N-able status: N-central Critical Security Incident (event 202561)](https://uptime.n-able.com/event/202561/)