New exploit code for N-able N-central has raised fresh concerns after researchers reported that servers running the latest emergency hotfix remain exposed. Published late on November 11, the tools, named 4EverAble2Shell and Agent2Shell, reportedly target N-central 2026.4 HF2, build 2026.4.1.26.
Huntress reviewed the code and warned that fully patched servers should still be treated as vulnerable. The disclosure comes just after N-able released its emergency N-central hotfix on November 10. That update addressed seven CVEs following the release of 33 alleged flaws under the Able2Shell name.
The new findings are separate claims against the patched build, not evidence that every earlier fix failed.
N-able N-central zero-day exploits
According to the researcher’s disclosure, 4EverAble2Shell provides remote code execution without login credentials and ends with root access on the N-central appliance. The researcher says Legacy API mode must be enabled.
Huntress’s initial code review supports the claimed unauthenticated root execution chain, but its findings do not establish successful attacks against customer servers.
According to seankbales, Agent2Shell targets communication between N-central servers and their Windows Agents and Probes.Agent2Shell targets communication between N-central servers and their Windows Agents and Probes.
Huntress describes more than ten issues, including two chains that could let an unauthenticated attacker run commands on managed Windows devices, including as SYSTEM.
The researcher also lists knowledge of the appliance ID as a requirement. This places connected endpoints, not just the management server, within the potential attack path.
The distinction matters for managed service providers. N-central supports remote administration across customer networks, so access to its server can carry risks beyond one appliance.
The earlier disclosure already prompted a worldwide hosted N-central shutdown. Huntress warns that the newly published chains could let attackers move from an exposed server to the Windows systems it manages.
In its November 12 technical update, Huntress said no fix was available for the new issues at publication time. It advised on-premises customers to take N-central offline again or remove internet access, even after installing HF2.
IP allowlisting alone may not be enough because affected interfaces also handle normal Agent and Probe connections. Defenders can review server logs for unusual requests to /dms/services/ServerUI and /dms2/services2/ServerMMS2, particularly messages using a session ID of -1.
Huntress also identified unexpected script backup files and a suspicious symbolic link involving flag_default.json. These indicators came from static review of the published code and had not been observed in real attacks.
On Windows, investigators should examine unexpected encoded PowerShell commands launched by N-able components, changes to Windows Software Probe files, and unexplained service restarts.
Normal support work can produce similar process activity, so context matters. Review activity from November 11 onward and investigate unexpected accounts, scripts, tasks, or remote sessions. Hosted customers should follow N-able’s status updates.
Suspicious findings should trigger an incident response review covering both the appliance and managed customer devices, rather than treating HF2 installation as proof of safety.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
