An update to my post on N-able’s N-central 2026.4 HF2. The same researcher, Sean Bales, has published new exploits that he says work against HF2 (build 2026.4.1.26), the release meant to fix his earlier Able2Shell bugs, The Hacker News reports.
What’s new
- 4EverAble2Shell: unauthenticated root RCE on on-prem N-central servers.
- Agent2Shell: chains more than 10 zero-days to run commands as SYSTEM on managed Windows agents, if the attacker knows the appliance ID.
- N-able says the server issue needs the non-default Legacy API turned on and exposed to the internet. Hosted environments aren’t affected.
- Previdian saw targeted probing within hours of the PoC, trying an Apache Axis flaw (CVE-2026-90436, patched Nov. 6) and then 4EverAble2Shell. watchTowr is seeing probes too. No confirmed successful exploitation yet.
What to do
Disable the Legacy API now. Make sure N-central isn’t reachable from the internet, apply the Axis fix, and watch for N-able’s next build.
My take
A patch that gets bypassed within days gets garlic. RMM servers can push code to every machine they manage, so they belong behind a VPN.
God Bless, and Needs Garlic!
