The Patch Landed. The Exploits Kept Working.

N-able shipped the hotfix on Tuesday. By Thursday, the exploits were back — two new sets, published by the same researcher who broke N-central the first time, and both of them work against the patched build. One gives an attacker root on the server without logging in. The other runs commands as SYSTEM on every managed Windows PC the server looks after.

It is the second act of a story that started on Sunday, when independent researcher Sean Bales published more than 30 alleged zero-days in N-central, the remote monitoring platform managed service providers use to run their clients’ networks. N-able took its hosted environments offline worldwide, told on-premise customers to shut their servers down, and shipped hotfix 2026.4.1.26 on November 10. That first disclosure is now closed. The new one is not.

Two new names, same target

Bales codenamed the new disclosures 4EverAble2Shell and Agent2Shell, and published proof-of-concept exploits for both. 4EverAble2Shell is unauthenticated remote code execution with root privileges on the N-central server itself — no username, no password, full control of the box that manages everything else. Agent2Shell chains more than ten zero-day flaws to run commands on managed Windows agents as NT AUTHORITY\SYSTEM, the highest privilege on a Windows machine, provided the attacker knows the target appliance ID.

The part that stings: both proof-of-concepts were tested against N-central 2026.4 Hotfix 2, build 2026.4.1.26 — the exact update N-able released to resolve the first batch. There is no fix for either new exploit yet. N-able says it is investigating the disclosure.

There is a catch, and it matters. According to N-able, the server-side issue depends on a configuration that is not the default: the Legacy API turned on and exposed to the public internet. The Legacy API is off by default and the company says it is not recommended. N-able is urging every customer to disable it immediately if it is on. Hosted environments are not affected. The exposure covers on-premise N-central in the Americas, Asia-Pacific, and Europe.

The probes started within hours

The window between disclosure and attack is already closing. Ryan Dewhurst, founder and CEO of threat intelligence firm Previdian, told The Hacker News that targeted probing against 4EverAble2Shell was observed within hours of the proof-of-concept release, coming from the IP address 157.20.241.16. There is no evidence of a successful break-in yet — but the attempts are real, and they follow a clear chain.

The observed attacks start with CVE-2026-90436, a 9.8-rated flaw in the end-of-life Apache Axis 1.x library, for which patches were released on November 6. Attackers use it for initial code execution, then try to escalate to root with 4EverAble2Shell, then download and run a shell script from 157.20.241.16 with curl. Dewhurst called it the first documented instance of exploitation attempts aimed at CVE-2026-90436. Researchers at watchTowr independently report seeing probes for 4EverAble2Shell aimed at N-central builds with the Legacy API enabled.

It is the same pattern the industry watched all week: remote-management tools are the target now. Days earlier, attackers hijacked ScreenConnect environments to push rogue remote-access clients to customer devices — 288 endpoints in 90 minutes. An RMM platform is a skeleton key: break the one server, and every machine it manages is in reach.

What to do now

If you run N-central on-premise, four checks, in order. First, disable the Legacy API now — and verify it is actually off, not just assumed off. Second, confirm your N-central server is not reachable from the public internet; if it is, that exposure is the problem, not just the API setting. Third, apply the fix for CVE-2026-90436 in Apache Axis, which shipped November 6. Fourth, hunt: look for any traffic to or from 157.20.241.16, any unexpected curl download launched by the N-central Java process, and any SYSTEM-level command on a managed agent that nobody on your team ran.

The hotfix bought about two days. Until N-able ships a fix for 4EverAble2Shell and Agent2Shell, the Legacy API switch is the defense — and the probing shows attackers already know where to look. This is a developing story: if the Legacy API is on anywhere in your environment, turn it off today, then check the logs.