New N-able zero-days exploited within hours of the proof of concept going public
Researcher Sean Bales published exploit code on November 12 for flaws in N-central 2026.4 HF2 — the hotfix N-able shipped November 10. Attackers were probing within hours, and researchers count at least 21 compromised servers.
📊 Scorecard: our Bearish call on $NABL is scored from $4.87, the last close before it ran. Its first result comes after the next close.
The News
The N-able story moved again within a day of the hotfix. Researcher Sean Bales published proof-of-concept code — working exploit code that demonstrates a flaw — on November 12 for two new zero-day sets, 4EverAble2Shell and Agent2Shell. A zero-day is a flaw nobody knew about until it was disclosed, so there is no patch waiting. Both work against N-central 2026.4 HF2 (build 2026.4.1.26), the hotfix N-able shipped on November 10 for the earlier Able2Shell flaws. In other words, the patch did not stop the new flaws.
4EverAble2Shell chains an Apache Axis flaw, CVE-2026-90436, rated 9.8 out of 10 in severity, with an unspecified N-central hole in deployments that have the Legacy API enabled. The Legacy API is an older connection method for the product. Together they give an unauthenticated attacker — one who does not need a username or password — remote code execution as root on the server, the highest level of access. Agent2Shell is roughly a dozen flaws that let an unauthenticated attacker run commands as SYSTEM, the Windows equivalent of root, on managed Windows computers.
Attackers did not wait. Threat researchers Previdian and Huntback observed probing from about 08:30 UTC and full exploitation from 09:16 UTC on November 12, roughly five hours after the proof of concept was published. Lupovis and Huntback report at least 21 compromised production N-central servers — 19 of them on the latest HF2 build — in the US, Canada, South Africa, the UK, Germany, France and Sweden. Each is running XMRig, a Monero cryptocurrency miner, kept alive with systemd or cron, the standard tools that restart programs automatically on Linux servers.
N-able restricted the Legacy API and its Intune integration on November 12, and said on November 13 that it had identified additional indicators of compromise — the technical fingerprints of an attack — and is working with specific customers. It has published those indicators for customers that have not disabled the Legacy API. There is no fix yet for 4EverAble2Shell or Agent2Shell. Two cautions: N-able has not confirmed Huntback's mining report, and the new flaws are not in CISA's exploited-vulnerabilities catalog.
Patched on Tuesday, exploited on Thursday — the hotfix did not stop the new flaws.
Why It Matters
Five hours from publication to exploitation is the number that matters. Proof-of-concept code is a double-edged tool: it lets defenders test their systems, but it also hands attackers a working weapon, and in this case the weapon was used the same morning. The 21 compromised servers are the researchers' count, not N-able's, and the mining report is unconfirmed — but 19 of the 21 were on the latest hotfix build, which is the detail that hurts, because it means the customers who did everything right are still exposed.
N-central is remote monitoring software: it manages other companies' computers, so a compromised server is a foothold into every customer it manages. That is why the Legacy API restriction came the same day — disabling it is the only mitigation until a fix exists. For the market, the open question is how far the 21-server count grows over the weekend, and whether any compromised server was used to reach the managed computers behind it.
Analyst's Take
Bearish, and the follow-up label matters: the hotfix story published on November 13 is already out of date. N-able's response has been fast — the Legacy API restriction and the indicators of compromise came within a day — but fast response is not the same as a fix, and there is no fix yet for either flaw set.
The open questions are how far the 21-server count grows over the weekend, whether any compromised server was used to reach the managed computers behind it, and when a patch lands. Until then, the only defence is disabling the Legacy API, which not every customer has done. Reader poll: have you disabled the Legacy API? Vote: Disabled already, Patching and waiting, Switching RMM tools, or Not affected.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is the difference between Able2Shell and 4EverAble2Shell?
Able2Shell was the earlier flaw set that N-able's November 10 hotfix (N-central 2026.4 HF2) addressed. 4EverAble2Shell and Agent2Shell are new zero-day sets disclosed November 12 that work against that same hotfix build, so the patch does not stop them.
What is the Legacy API, and why does disabling it help?
The Legacy API is an older connection method for N-central. 4EverAble2Shell needs it enabled to chain its two flaws, so N-able restricted it on November 12 and published indicators of compromise for customers that have not disabled it.
Is the 21-server count confirmed?
It is the researchers' count (Lupovis and Huntback), not N-able's. N-able has not confirmed the mining report, and the new flaws are not in CISA's exploited-vulnerabilities catalog. N-able said on November 13 it had identified additional indicators of compromise and is working with specific customers.
What should N-central customers do now?
Disable the Legacy API if it is still enabled, check the indicators of compromise N-able published, and watch for a fix — there is none yet for 4EverAble2Shell or Agent2Shell.
👁
Source: SecurityWeek