What happened. Security researcher Sean Bales, who disclosed the Able2Shell N-central bugs earlier this week, published two new exploits on Nov 12: 4EverAble2Shell and Agent2Shell. He says both work against N-central 2026.4 Hotfix 2 (build 2026.4.1.26), the emergency update N-able shipped on Nov 10. N-central is the remote monitoring and management (RMM) platform MSPs use to run their customers' machines, so a compromised server can reach every endpoint it manages.
How it works, in plain words. 4EverAble2Shell lets an attacker with no login run commands as root on the N-central server, but only when the Legacy API is turned on. It chains a flaw in the Apache Axis web-services library, CVE-2026-90436 (CVSS 9.8), which gives code execution as the low-privilege nable service account, with a local trick that abuses an N-central helper script to climb to root. Agent2Shell goes after N-central's agents instead: Bales says it uses more than 10 zero-day bugs to run commands as SYSTEM on managed Windows machines, if the attacker knows the target appliance ID.
Already exploited. The proof of concept went public at 03:58 UTC on Nov 12. Huntback saw IP 157.20.241[.]16 probing its N-central decoys at about 08:30 UTC and running the full chain from 09:16 UTC, installing an XMRig Monero miner set to use about half the CPU cores so it is harder to notice. At 12:50 UTC, the attacker's mining pool listed 21 active miners named after N-central servers; 19 of the 21 reported the Hotfix 2 build. Victims were in the US, Canada, South Africa, the UK, Germany, France and Sweden. Previdian saw the same IP probing.
What N-able says. In its latest update N-able tells on-premises customers to install Hotfix 2 and keep servers off the internet until then, says all unauthenticated bugs it had identified are fixed, and says it sees scanning but no sign of compromise on its hosted servers. As of this writing it had not published a fix aimed at 4EverAble2Shell or Agent2Shell.
Do now. Turn off the Legacy API, and keep internet-facing on-prem N-central servers offline or behind a VPN until N-able ships a fix for these chains; Hotfix 2 alone did not stop them. Hunt for unexpected XMRig processes, outbound connections to 157.20.241[.]16, and POST requests to /dms/services/ServerUI (Huntback's indicators), and treat any hit as a full server compromise, since root on an RMM server means reach into every client.