Able2Shell

14 Nov 2026. CSIRT Italia AL02/261113/CSIRT-ITA (published 13 Nov 2026, 10:42 Italian time) reports active exploitation of CVE-2026-90436 in Apache Axis and notes a public PoC. Original on the ACN CSIRT Italia page; Toscana CSIRT is a verified regional mirror. The alert names no victims, sectors, IOCs, or first-seen date. Apache has published no exploitation statement. That CVE's catalog page stays Reported exploited (government: CSIRT Italia, 13 Nov 2026). See Apache Axis CVE-2026-90436. Able2Shell badge stays Reported exploited (huntback). Rechecked CISA KEV catalog 2026.11.13 (1,781 entries) on 14 Nov 2026: still not listed, including CVE-2026-90436. N-able still has no statement naming that CVE.

Evening 13 Nov 2026. N-able incident 202613 JSON fetched (status Identified, start 2026-11-12T16:00:00 UTC). Update timestamped 2026-11-13T03:50:42 UTC: "Through our ongoing investigation today, we have identified additional Indicators of Compromise (IOCs) and are working closely with those specific customers to assess and mitigate any potential risks." This page records that as N-able reporting IoCs at specific customers. It is not a vendor ITW mark for 4EverAble2Shell. The 12 Nov 202613 description still says: "Importantly, we have seen no signs of compromise. We are continuing to monitor closely and will provide updates as needed." SecurityWeek 13 Nov quotes the same 13 Nov IoC sentence and links that incident. Lupovis, quoted by SecurityWeek: 21 rigs on compromised N-central servers in the US (9), South Africa (4), Canada (4), the UK, Germany, France and Sweden. Lupovis: "Our decoys never execute anything, so none of the listed rigs are ours. Every one is a real server that ran the chain to root." That 21 matches huntback's 21 nc_ rigs already on this page. SecurityWeek quotes WatchTowr seeing probes for 4EverAble2Shell on builds with Legacy API enabled. N-able 202613: no fix yet; Legacy API off by default; Intune turned off on hosted and temporarily deactivated on-prem; developing additional remediation. Rechecked CISA KEV catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries) on 13 Nov 2026 18:55 SGT: still not listed, including CVE-2026-90436. Badge stays Reported exploited.

13 Nov 2026. huntback Research published 12 Nov 2026 the first public third-party report of successful in-the-wild 4EverAble2Shell use on production N-central servers, including 2026.4 HF2 build 2026.4.1.26. Weaponised requests from 09:16 UTC 12 Nov (17:16 SGT), about five hours after huntback's 03:58 UTC public-PoC timestamp; by 12:50 UTC (20:50 SGT) the operator's public mining pool listed 21 rigs named nc_, all serving N-central login pages, 19 reporting 2026.4.1.26, and huntback also names one on 2025.3.1.9. Outcome: an XMRig Monero miner running as root. huntback: the chain started with Apache Axis code execution as the nable user, then local root, then the miner installer. huntback does not print a CVE ID for that Axis step. THN (12 Nov) named Apache Axis CVE-2026-90436 as the first step of the Previdian-observed attempt chain; this page names that CVE only because THN does, and does not treat huntback as having assigned it. Badge: Reported exploited. N-able has not confirmed huntback's mining report. N-able 12 Nov incident 202609: the server issue depends on Legacy API being on and exposed; Legacy API is off by default; keep it disabled; hosted not affected by this issue; no fix yet. The Hacker News 12 Nov, quoting Dewhurst, still said there is no evidence of successful exploitation as of writing, so THN is not used here as corroboration of huntback's success claim. Not in CISA KEV (catalog 2026.11.10, 1,779 entries, checked 13 Nov 2026 18:55 SGT) for the seven HF2 CVEs or CVE-2026-90436.

Evening 12 Nov 2026. N-able incident 202609 (status Investigating, start 2026-11-12T07:00:00 UTC, timezone UTC on the dashboard) says N-able is investigating a new public disclosure containing claims of additional vulnerabilities in N-central On-Premises 2026.4.1 HF2. Verbatim from that incident: Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet. Legacy API is turned off by default in the product and is not recommended. On-premises: if Legacy API is enabled, disable it now (N-able links a login how-to); all other customers should confirm it is disabled. Hosted environments are not affected by this issue. N-able says its Security and Engineering teams are assessing the claims, including which versions may be in scope, and will share findings on that page. The incident names on-prem Americas, APAC, and Europe. It does not name 4EverAble2Shell or Agent2Shell, does not publish a fix build, and does not assign a CVE.

The Hacker News (Ravie Lakshmanan, 12 Nov 2026) quotes that incident and maps the new shortcomings to 4EverAble2Shell and Agent2Shell, repeating the researcher's claim that the published PoCs work against 2026.4 HF2 build 2026.4.1.26. THN: 4EverAble2Shell is unauthenticated remote code execution with root on the server; Agent2Shell uses more than ten issues to run commands on managed Windows agents as NT AUTHORITY\SYSTEM if the attacker knows the target appliance ID. This page treats the N-able Legacy API statement as covering the server issue / 4EverAble2Shell only. Agent2Shell still has no vendor statement.

Previdian VULN-2026-0009, published 12 Nov 2026 06:12 UTC (14:12 SGT) and with a page-image cache stamp 10:05:56 UTC (18:05 SGT), describes an unauthenticated 4EverAble2Shell chain reported to reach root, tested by the researcher against Appliance 2026.4.1.26 (HF2). Previdian: complete affected-version range and a fixed build have not been verified. Public sensor card: 2 attempts, 1 unique attacker IP, 1 country (IN), first and last observed 12 Nov 2026. Previdian says those observations are attempts and do not show that the target was vulnerable or that the attempt succeeded. The public page does not list the IP.

THN quoting Dewhurst: targeted probing against 4EverAble2Shell within hours of the PoC, source IP 157.20.241[.]16, no evidence of successful exploitation as of writing. Attempted chain in that report: initial code execution through Apache Axis CVE-2026-90436 (CVSS 9.8, patches 6 Nov 2026 per THN), then privilege to root using 4EverAble2Shell, then a shell script fetched with curl from that IP. CVE-2026-90436 is stated here only because THN names it verbatim; it is not an Able2Shell CVE on this page. THN also reports watchTowr seeing probes for 4EverAble2Shell on Legacy-API-enabled builds.

12 Nov 2026. Huntress posted an update at 1:10 AM ET that day. Late on 11 Nov, the Able2Shell researcher released two further public chains against N-able N-central: 4EverAble2Shell and Agent2Shell. Huntress records the researcher's claim that both still work on 2026.4 HF2 build 2026.4.1.26. Huntress's first look was a static review of the published code, not a live exploit run. 4EverAble2Shell, per that review, is unauthenticated remote code execution that ends as root on the N-central server and does not need credentials. Agent2Shell is a set of more than ten problems in server-to-Windows Agent and Probe communication. Two of those paths, Huntress says, let an unauthenticated attacker who can reach the server run commands on managed Windows endpoints, including as SYSTEM. Combined, Huntress says an attacker could start at an internet-facing N-central server and continue onto the endpoints that server manages. Huntress says operators should treat a fully patched N-central server as still vulnerable. Huntress also says no fix was available when that update was written.

Dispute on whether HF2 closed unauthenticated issues. On 11 Nov 2026 N-able published a follow-up on 2026.4 HF2. In our words: N-able said it had addressed every identified issue that an unauthenticated user could exploit, that leftover issues need a signed-in N-central account (often a privileged one) or other limits on exploitability, and that more hotfixes are coming. Huntress's 12 Nov write-up describes new unauthenticated chains that the researcher says still work on HF2. This page records that disagreement above the fold. As of the morning 12 Nov Huntress update there was no vendor statement yet on 4EverAble2Shell or Agent2Shell by those names. Evening 12 Nov: N-able incident 202609 is a vendor statement on the on-prem server issue and Legacy API, which THN maps to 4EverAble2Shell; Agent2Shell still has no vendor statement. Huntress 12 Nov, N-able 11 Nov, and incident 202609 do not assign CVE IDs for those chains. The seven published HF2 CVEs remain the IDs for builds older than 2026.4.1.26.

Able2Shell is the public name for a set of N-able N-central findings published by independent researcher Sean Bales (Huntress 9 Nov 2026; SecurityWeek, The Hacker News, and CSO Online 10 Nov 2026; BleepingComputer 11 Nov 2026). Huntress, Rapid7, and the public Able2Shell README describe 33 findings and four exploit chains. N-able's 2026.4 HF2 notes list seven CVEs for the hotfix. CSO Online (Lucian Constantin, 10 Nov 2026): N-able has not confirmed how many of the 33 flaws it could reproduce, but the new hotfix lists 7 CVEs. BleepingComputer (11 Nov 2026): HF2 has patches for some of the leaked zero-days, including the most critical, and lists those seven CVEs. BleepingComputer's earlier article described more than 30 alleged zero-days. N-able uptime event 202584: a follow-up hotfix will be released to provide further security updates. This page does not republish exploit code, payloads, endpoints, or reproduction steps.

Lead CVE and CVSS. N-able CNA published CVE-2026-125883 on 10 Nov 2026 at 21:19:11.273Z (state PUBLISHED): Multiple XXE Vulnerabilities, CWE-611, CAPEC-146 XML Schema Poisoning. Description: Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1. CVSS 4.0 9.3 Critical, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. This is the primary CVE on this page because it matches the unauthenticated XXE lead chain. Official vendor advisories are on me.n-able.com (login). NVD HTML detail page timed out when fetched 11 Nov 2026; an NVD listing showed Received, no NVD-produced Primary. FIRST EPSS returned total 0 for this CVE and the six siblings (checked 11 Nov 2026).

Sibling CVEs in the same HF2 (N-able CNA, all PUBLISHED 10 Nov 2026, affected N-central before 26.4.1 unless noted; descriptions and CVSS 4.0 scores below match the CNA records fetched 11 Nov 2026). CVE-2026-125878 CNA description: Improper neutralization of input during web page generation (cross-site scripting) vulnerability in N-able N-central allows Resource Injection. CWE-79, CVSS 4.0 8.7 High, PR:L, published 21:22:40.630Z. CNA title, HF2 notes, and BleepingComputer list this ID as Multiple OGNL Injection vulnerabilities, so the CVE description and those titles differ. CVE-2026-125879 CNA description: Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. CNA title: Local privilege escalation to root via nable-writable syslog-ng config. CWE-266, CVSS 4.0 8.6 High, PR:H, published 21:23:18.540Z. CVE-2026-125880 CNA description: Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS). CNA title: Stored XSS via MMS3 patch metadata (admin context). CWE-644, CVSS 4.0 8.3 High, PR:H UI:A, published 21:26:05.050Z. CVE-2026-125881 CNA description: Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. CNA title: Schema-hint SSRF via service import schema validation. CWE-918, CVSS 4.0 9.3 Critical, PR:N, published 21:24:33.606Z. CVE-2026-125882 CNA description: Relative path traversal vulnerability in N-able N-central allows Path Traversal. CNA title: RCE via file repository upload path traversal. CWE-23, CVSS 4.0 8.6 High, PR:H, finder Nate Fair, Sprocket Security, published 21:25:23.173Z. CVE-2026-91000 CNA description: Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. CNA title: Insecure IPC Channels lead to local privilege escalation. CWE-306, CVSS 4.0 8.4 High, AV:L PR:L, CNA affected before 2026.4.1 (not 26.4.1), published 21:19:57.597Z. These IDs are aliases on this page, not separate catalog pages.

Lead chain, from Rapid7 (10 Nov 2026) and the researcher README: unauthenticated XML external entity (XXE) in service import, trusted-session takeover, administrator, command execution as the nable service account. Huntress: successful use of the RMM can reach managed endpoints. The README also says that chain can create an enabled Default Administrator account. Conceptual impact class only.

Other chains, from Rapid7: an administrator viewing malicious patch metadata, or ProductAdmin credentials. Huntress: three of the four chains reach remote code execution as the nable service account or root; one is local privilege escalation to root. The README titles those four chains at a high level (anonymous service-import XXE to nable RCE; anonymous stored XSS to OGNL nable RCE; anonymous stored XSS to Audit Export root RCE; SIS traversal then syslog helper to root). This page does not expand those titles into steps.

Fixed version for the seven HF2 CVEs. N-able N-central 2026.4 HF2 Release Notes (posted 10 Nov 2026, Last Updated 10 Nov 2026): Build Number 2026.4.1.26. Huntress UPDATE 10 Nov 5:30 PM ET: On November 10, N-able released N-central 2026.4 HF2, (build 2026.4.1.26). Huntress UPDATE 12 Nov 2026 1:10 AM ET: that build is not a complete fix for 4EverAble2Shell or Agent2Shell; treat even a fully patched server as vulnerable, and no fix was available then. CNA records say before 26.4.1 (CVE-2026-91000: before 2026.4.1). This page uses the vendor build 2026.4.1.26 as the fix for the seven HF2 CVEs and notes the CNA version string. Rapid7's Emergency Threat Response (last updated 10 Nov 2026, Initial publication) still says N-able's notice does not yet include CVE identifiers or a remediation build; that article is stale against the vendor notes.

Hosted N-central. HF2 notes: If you are on an N-central hosted instance (NCOD), N-able will upgrade your server for you. You do not need to upgrade your server. You must still upgrade your Agents and Probes. Huntress 12 Nov 2026: hosted servers run the same 2026.4.1.26 build as on-prem HF2, so watch N-able's status page for guidance on the new chains. That is not a vendor statement on 4EverAble2Shell or Agent2Shell. N-able uptime event 202584 update timestamped 2026-11-11 01:04 UTC: All Hosted N-central servers (NCODs) across all global regions have been successfully upgraded. BleepingComputer (11 Nov 2026) reports that update. Huntress UPDATE 10 Nov 5:30 PM ET had already said N-able updated all hosted N-central servers and brought them back online. The earlier outage: Huntress incident opened 9 Nov 2026 at 15:15 UTC. The Hacker News quotes N-able on the precautionary hosted outage. Ecoverse services under N-able Login remaining available (The Hacker News quoting N-able) is not an N-central restore.

On-prem. HF2 notes: customers running on-premises N-central deployments should upgrade their servers as soon as possible. Huntress UPDATE 10 Nov: keep them offline until the upgrade is complete. Huntress UPDATE 12 Nov 2026 1:10 AM ET: take the server offline again, or remove all internet access, even if 2026.4 HF2 is already installed, and keep it offline until N-able issues guidance for the new chains. Huntress: do not rely on IP allowlisting alone, because Agents and Probes check in on the same affected endpoints. Supported upgrade paths to 2026.4.1.26: 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1 to Hotfix 4, 2026.4 build 2026.4.0.27, 2026.4 Hotfix 1 build 2026.4.0.32. Earlier: No, upgrade to a supported version first (HF2 notes). That is a path constraint, not a not-affected statement.

Agents and Probes. HF2 notes: All customers, both hosted and on-premises, must upgrade their Agents and Probes. Upgrade Agents first, then Probes. Compatibility: a Probe not yet on 2026.4.1.26 still talks to Agents as today; a Probe on 2026.4.1.26 cannot talk to an Agent or PME that is not also on 2026.4.1.26. Known issue: built-in remote control is temporarily disabled; Take Control continues to work.

Exploitation. Huntress UPDATE 12 Nov 2026 1:10 AM ET: potential indicators for the new chains were taken from static code review and none have been observed in the wild. Huntress UPDATE 10 Nov 2026 5:30 PM ET quotes N-able on scanning associated with the published PoC and no evidence of successful customer exploitation, and says Huntress has not observed evidence of Able2Shell exploitation in partner environments. N-able 11 Nov 2026 HF2 follow-up: scanning associated with the public proof-of-concept, and no indications of compromise within hosted N-central servers. Rapid7 (10 Nov 2026) recorded the same N-able scanning statement. The Hacker News (10 Nov 2026) reports watchTowr honeypot attempts overnight after the drop. CSO Online (10 Nov 2026) cites Previdian: 68 exploitation attempts against one honeypot from a single IP within about 18 hours of publication; the article does not publish the IP. Defused (10 Nov 2026 15:32 UTC), quoted by BleepingComputer (11 Nov 2026): probing of N-central for the publicly dropped zero-days, including anonymous agent sessions, appliance config pulls, and unauthenticated hits on the remote-control endpoint. BleepingComputer: N-able has yet to flag these flaws as exploited in the wild. Page badge from 13 Nov 2026: Reported exploited (huntback 12 Nov mining report), not vendor-confirmed. Never a not-exploited mark.

Exposure. BleepingComputer (11 Nov 2026) citing Shadowserver: just over 148 internet-exposed N-central servers on 11 Nov, down from 1,338 on Monday 9 Nov. CSO Online (10 Nov 2026) citing Censys: 1,728 internet-exposed instances. Those are different scanners and dates. Exposure counts, not vulnerable or compromise counts.

KEV. Not in CISA KEV (catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries, checked 13 Nov 2026 18:55 SGT) for CVE-2026-125883 or the six siblings. Prior N-central rows in that same catalog (CVE-2026-86218, CVE-2026-18556, CVE-2026-18577) are separate 2026 incidents; this page does not treat them as Able2Shell.

This incident is separate from earlier 2026 N-central CVEs that Huntress tracked: CVE-2026-18556 and CVE-2026-18577 (August), CVE-2026-86218 (September, exploited pre-auth RCE), and Huntress's own CVE-2026-86206 / CVE-2026-86207 chain. Those IDs were verified in CISA KEV catalog 2026.11.10 for 86218 / 18556 / 18577 only; 86206 and 86207 are Huntress-named and are not KEV-listed. No existing vuln2shell pages cover those CVEs.

Credit: Sean Bales (SecurityWeek, The Hacker News, CSO Online). CVE-2026-125882 finder: Nate Fair, Sprocket Security (CNA record and HF2 notes). Huntress byline: Lindsey O'Donnell-Welch and Susannah Matt (9 Nov 2026, updated 12 Nov 2026 1:10 AM ET).

The Apache Axis CVE named in that chain is on the Apache Axis CVE-2026-90436 page.