N-able is investigating new vulnerability disclosures affecting on-premise N-central version 2026.4.1 HF2, including issues codenamed 4EverAble2Shell and Agent2Shell.
The flaws require a non-default configuration where the Legacy API is exposed to the public internet.
Review the advisory details, affected configurations, and recommended checks.
When does the problem occur?
The vulnerabilities only appear if an older feature of the platform, known as the Legacy API, is enabled. This feature is disabled by default, and N-able urges users to make sure it remains turned off. If it is enabled, attackers could gain access to the company's systems.
The 4EverAble2Shell and Agent2Shell security vulnerabilities
The problems were uncovered by researcher Sean Bales and concern two different points:
- 4EverAble2Shell: It allows someone to execute commands remotely on computers managed by N-central, without the need for passwords, gaining full control of the servers.
- Agent2Shell: It exploits over 10 other security vulnerabilities to run commands on Windows computers managed by N-central, as long as the attacker knows the device's identity.
Attack attempts
Immediately after the publication of information about these gaps, cybersecurity companies, such as Previdian and watchTowr, detected attempts by unknown parties to check whether the systems of various organizations are vulnerable.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Serious security flaw in MongoDB: How your database could collapse
↗
In some cases, the attackers attempted to execute a chain of actions: first, they attempted to execute code via a known issue that was fixed on November 6, then they attempted to escalate their privileges using 4EverAble2Shell, and finally they attempted to download and execute an automated script. Despite these efforts, there is no evidence to date that any attack has successfully compromised a system.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
