{"slug":"able2shell-n-able-n-central","title":"Able2Shell: N-able N-central exploit chains (CVE-2026-125883)","shortName":"Able2Shell","seoTitle":"Able2Shell (CVE-2026-125883): versions, exploitation & detection","summary":"14 Nov 2026: CSIRT Italia AL02/261113/CSIRT-ITA (13 Nov 2026, 10:42 Italian time) reports active exploitation of CVE-2026-90436 in Apache Axis and notes a public PoC. Apache has published no exploitation statement. That CVE's catalog page stays Reported exploited (government: CSIRT Italia, 13 Nov 2026). Able2Shell badge stays Reported exploited (huntback). The alert names no victims, sectors, IOCs, or first-seen date. N-able still has no statement naming CVE-2026-90436 and no Able2Shell fix. Not in CISA KEV (catalog 2026.11.13, 1,781 entries, checked 14 Nov 2026).","isExample":false,"draft":false,"family":"able2shell-n-able-n-central","kind":"single-product","aliases":["CVE-2026-125883","CVE-2026-125878","CVE-2026-125879","CVE-2026-125880","CVE-2026-125881","CVE-2026-125882","CVE-2026-91000","Able2Shell","N-able N-central Able2Shell","N-central Able2Shell","N-central 2026.4 HF2","4EverAble2Shell","Agent2Shell"],"publishedAt":"2026-11-11","updatedAt":"2026-11-14","patchStatus":"partly-patched","exploited":"reported","scores":{"cve":"CVE-2026-125883","cvss":{"cve":"CVE-2026-125883","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0","scorer":"cna","sourceUrl":"https://cveawg.mitre.org/api/cve/CVE-2026-125883","sourceDate":"2026-11-10","checkedDate":"2026-11-11","dateLabel":"CNA published","sourceLabel":"N-able CNA (CVSS 4.0 9.3 Critical, CWE-611, published 2026-11-10T21:19:11.273Z). NVD HTML detail page timed out when fetched 11 Nov 2026; an NVD listing showed Received, no NVD-produced Primary. FIRST EPSS total 0 for this CVE and the six siblings.","nvdPublishedDate":"2026-11-10"},"epss":{"cve":"CVE-2026-125883","score":null,"percentile":null,"date":null,"sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-125883","checkedDate":"2026-11-11"},"kev":{"cve":"CVE-2026-125883","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.11.13","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-14"},"addedDate":"2026-11-11"},"priority":{"label":"act-now"},"managementSummary":{"what":"14 Nov 2026: CSIRT Italia AL02/261113 reports active exploitation of CVE-2026-90436 (Apache Axis). Apache has published no exploitation statement. That CVE's page stays Reported exploited (government: CSIRT Italia). Able2Shell badge stays Reported exploited (huntback). No Able2Shell fix. N-able still has not named CVE-2026-90436. Not in CISA KEV (catalog 2026.11.13, checked 14 Nov 2026).","action":"Keep Legacy API disabled (N-able 12 Nov and 13 Nov). Hosted: N-able turned off Intune as a precaution. If Legacy API was enabled and internet-exposed since 12 Nov 2026, treat the server as potentially compromised and hunt the huntback artefacts in Detection. For Agent2Shell, Huntress still says take the server offline or cut all internet access until there is a fix. Hosted server issue: N-able 12 Nov incident 202609 says hosted is not affected by this issue; still watch 202609 and 202613."},"seenInTheWild":[{"metric":"scanning","value":"Scanning activity associated with the published proof-of-concept code","observer":"N-able","date":"2026-11-10","method":"Huntress UPDATE 10 Nov 2026 5:30 PM ET quotes N-able on scanning activity associated with the published proof-of-concept code. Rapid7 (10 Nov 2026) recorded the same vendor statement. That is sourced scanning, not a confirmed compromise. Badge: Exploitation attempts.","sourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains"},{"metric":"scanning","value":"Exploitation attempts against N-central honeypots overnight after Able2Shell was dropped","observer":"watchTowr","date":"2026-11-10","method":"The Hacker News (10 Nov 2026) reports a watchTowr post on X: observed exploitation attempts against N-able N-central honeypots overnight following the Able2Shell zero-days being dropped. Third-party honeypot attempts, not a vendor confirmation of customer compromise.","sourceUrl":"https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html"},{"metric":"scanning","value":"68 exploitation attempts against one honeypot from a single IP within about 18 hours of publication","observer":"Previdian","date":"2026-11-10","method":"CSO Online (Lucian Constantin, 10 Nov 2026) citing Previdian. The article does not publish the IP. Third-party honeypot attempts, not a vendor confirmation of customer compromise. Badge: Exploitation attempts.","sourceUrl":"https://www.csoonline.com/article/4247028/n-able-n-central-gets-emergency-fix-two-days-after-33-exploits-published.html"},{"metric":"scanning","value":"Targeted probing: anonymous agent sessions, appliance config pulls, unauthenticated hits on the remote-control endpoint","observer":"Defused","date":"2026-11-10","method":"Defused post 10 Nov 2026 15:32 UTC, also quoted by BleepingComputer (Sergiu Gatlan, 11 Nov 2026). Third-party probing of the public drop, not a vendor confirmation of customer compromise. Badge: Exploitation attempts.","sourceUrl":"https://x.com/DefusedCyber/status/2120177846970691916"},{"metric":"exposed","value":1728,"observer":"Censys","date":"2026-11-10","method":"CSO Online (Lucian Constantin, 10 Nov 2026) citing Censys: 1,728 internet-exposed N-central instances. That is an exposure count, not a vulnerable or compromise count. CSO does not publish a fingerprint, port, or query. Do not treat this as a vuln2shell scan. Separate from the later Shadowserver figures via BleepingComputer.","sourceUrl":"https://www.csoonline.com/article/4247028/n-able-n-central-gets-emergency-fix-two-days-after-33-exploits-published.html"},{"metric":"exposed","value":1338,"observer":"Shadowserver","date":"2026-11-09","method":"BleepingComputer (Sergiu Gatlan, 11 Nov 2026) citing Shadowserver: 1,338 internet-exposed N-central servers detected on Monday. Relative to that 11 Nov article, Monday is 9 Nov 2026. Exposure count, not a vulnerable or compromise count. Numbers cited from BleepingComputer, not a live Shadowserver scrape.","sourceUrl":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/"},{"metric":"exposed","value":"just over 148 internet-exposed N-central servers","observer":"Shadowserver","date":"2026-11-11","method":"BleepingComputer (Sergiu Gatlan, 11 Nov 2026) citing Shadowserver: just over 148 N-central servers currently exposed online. Exposure count, not a vulnerable or compromise count. Numbers cited from BleepingComputer, not a live Shadowserver scrape. Shadowserver IoT time-series dashboard linked as context only.","sourceUrl":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/"},{"metric":"vendor-stated","value":"No evidence that any customer environment had been successfully exploited","observer":"N-able","date":"2026-11-10","method":"Huntress UPDATE 10 Nov 2026 5:30 PM ET quotes N-able: no evidence that any customer environment had been successfully exploited. Rapid7 (10 Nov 2026) recorded the same statement. Huntress: as of that writing, Huntress has not observed evidence of Able2Shell exploitation in partner environments. Never a not-exploited mark. Badge: Exploitation attempts because scanning is sourced.","sourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains"},{"metric":"vendor-stated","value":"Scanning associated with the public proof-of-concept; no indications of compromise on hosted N-central servers","observer":"N-able","date":"2026-11-11","method":"N-able 11 Nov 2026 HF2 follow-up. The no-compromise clause is for hosted N-central servers. Confirming any one customer environment needs that environment's own assessment. Badge: Exploitation attempts because scanning is sourced.","sourceUrl":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response"},{"metric":"third-party-stated","value":"New-chain indicators extracted from static code review; none observed in the wild","observer":"Huntress","date":"2026-11-12","method":"Huntress UPDATE 12 Nov 2026 1:10 AM ET. Static review of published 4EverAble2Shell and Agent2Shell code. Not a confirmed compromise. Huntress 10 Nov separately said it had not seen Able2Shell exploitation in partner environments. Badge: Exploitation attempts.","sourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains"},{"metric":"scanning","value":"2 exploitation attempts, 1 unique attacker IP, first observed 12 Nov 2026; sensors do not show success","observer":"Previdian","date":"2026-11-12","method":"Previdian VULN-2026-0009, published 12 Nov 2026 06:12 UTC (14:12 SGT), page image stamp 10:05:56 UTC (18:05 SGT). Public page: 2 attempts, 1 unique attacker IP, 1 country (IN), first and last observed 12 Nov 2026. Exploit status: Exploitation Attempts Observed in the Wild. Previdian says confidence Confirmed is about treating the evidence as attempts against this vulnerability, and does not mean the attempt succeeded. The public page does not list the IP (Pro and Enterprise). Badge: Exploitation attempts.","sourceUrl":"https://previdian.com/VULN-2026-0009"},{"metric":"scanning","value":"Targeted 4EverAble2Shell probing within hours of the PoC; one reported source IP 157.20.241[.]16; no evidence of successful exploitation","observer":"The Hacker News","date":"2026-11-12","method":"The Hacker News (Ravie Lakshmanan, 12 Nov 2026) quoting Ryan Dewhurst of Previdian. Single reported IP, defanged here, labelled single-source. Not copied from the public Previdian page. THN describes the attempted chain as Apache Axis CVE-2026-90436 then root via 4EverAble2Shell, then a shell script fetched with curl from that IP. This page does not treat that as a successful compromise. Badge: Exploitation attempts.","sourceUrl":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html"},{"metric":"scanning","value":"Probes for 4EverAble2Shell targeting N-central builds with Legacy API enabled","observer":"watchTowr","date":"2026-11-12","method":"SecurityWeek (Ionut Arghire, 13 Nov 2026) quotes WatchTowr: \"New N-able zero-days are out, and WatchTowr Intel is already seeing probes for ‘4EverAble2Shell’, which affects builds with the Legacy API enabled.\" Earlier citation was The Hacker News aggregator of the same X post; direct X fetch had failed. Third-party probing, not a vendor ITW mark. Badge: Reported exploited because huntback's mining report stands.","sourceUrl":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/"},{"metric":"vendor-stated","value":"Investigating on-prem 2026.4.1 HF2 claims; initial review says the server issue needs Legacy API on and internet-exposed; hosted not affected by this issue","observer":"N-able","date":"2026-11-12","method":"N-able incident 202609 JSON fetched 12 Nov 2026. Status Investigating, start 2026-11-12T07:00:00 UTC, services N-central On-premise Americas / APAC / Europe. No fix and no CVE in that incident. N-able does not name 4EverAble2Shell or Agent2Shell. THN maps the server issue to 4EverAble2Shell. Badge stays Exploitation attempts because third-party attempts are sourced.","sourceUrl":"https://uptime.n-able.com/event/202609/"},{"metric":"third-party-stated","value":"21 live N-central servers mining as nc_ rigs at 12:50 UTC 12 Nov, 19 on 2026.4.1.26; XMRig as root after 4EverAble2Shell","observer":"huntback","date":"2026-11-12","method":"huntback Research, 12 Nov 2026. First public third-party report of successful 4EverAble2Shell use on production N-central, including HF2. Weaponised from 09:16 UTC (python-requests/2.31.0) from 157.20.241[.]16. Not vendor-confirmed. Badge: Reported exploited. Not exploitation-confirmed.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers"},{"metric":"vendor-stated","value":"Additional indicators of compromise at specific customers","observer":"N-able","date":"2026-11-13","method":"N-able incident 202613 JSON fetched 13 Nov 2026. Update 2026-11-13T03:50:42 UTC: \"Through our ongoing investigation today, we have identified additional Indicators of Compromise (IOCs) and are working closely with those specific customers to assess and mitigate any potential risks.\" Worded as N-able reporting IoCs at specific customers. Not a vendor ITW mark for 4EverAble2Shell. The 12 Nov 202613 description still says N-able has seen no signs of compromise. Badge stays Reported exploited.","sourceUrl":"https://uptime.n-able.com/event/202613/"},{"metric":"third-party-stated","value":"21 miners on compromised N-central servers (US 9, South Africa 4, Canada 4, plus UK, Germany, France, Sweden)","observer":"Lupovis","date":"2026-11-13","method":"Lupovis quoted by SecurityWeek, 13 Nov 2026. Wallet geography as published. Lupovis: \"Our decoys never execute anything, so none of the listed rigs are ours. Every one is a real server that ran the chain to root.\" Each victim miner is named after its IP address. The 21 matches huntback's 21 nc_ rigs (12 Nov), already sourced on this page. Not a vendor ITW mark. Badge: Reported exploited.","sourceUrl":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/"}],"seenInTheWildLinks":[{"title":"Able2Shell FAQ, N-able N-central zero-days and Hotfix 2","url":"https://www.tenable.com/blog/able2shell-frequently-asked-questions-for-reported-n-able-n-central-zero-day-vulnerabilities","observer":"Tenable","metric":"vendor-stated"},{"title":"New N-able 4EverAble2Shell zero-day exploited hours after PoC released","url":"https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/","observer":"BleepingComputer","metric":"third-party-stated"},{"title":"N-central Critical Security Update (incident 202613)","url":"https://uptime.n-able.com/event/202613/","observer":"N-able","metric":"vendor-stated"},{"title":"Hackers Exploit New N-central Zero-Day Hours After PoC Publication","url":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","observer":"SecurityWeek","metric":"third-party-stated"},{"title":"4EverAble2Shell is already mining Monero on live N-central servers","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","observer":"huntback","metric":"third-party-stated"},{"title":"VULN-2026-0009 Exploitation Attempts Observed, N-central","url":"https://previdian.com/VULN-2026-0009","observer":"Previdian","metric":"scanning"},{"title":"New N-central Exploits Work Against Patched Servers","url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","observer":"The Hacker News","metric":"scanning"},{"title":"N-central Critical Security Incident - 2026.4.1 HF2 Release","url":"https://uptime.n-able.com/event/202609/","observer":"N-able","metric":"vendor-stated"},{"title":"N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","observer":"Huntress","metric":"scanning"},{"title":"Rapid7: critical vulnerabilities in N-able N-central prompt hosted shutdown","url":"https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown/","observer":"Rapid7","metric":"scanning"},{"title":"N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits","url":"https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html","observer":"The Hacker News","metric":"scanning"},{"title":"N-able N-central gets emergency fix two days after 33 exploits published","url":"https://www.csoonline.com/article/4247028/n-able-n-central-gets-emergency-fix-two-days-after-33-exploits-published.html","observer":"CSO Online","metric":"scanning"},{"title":"N-able releases security hotfixes for zero-day vulnerabilities","url":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/","observer":"BleepingComputer","metric":"exposed"},{"title":"Shadowserver IoT devices time-series (N-able N-central)","url":"https://dashboard.shadowserver.org/statistics/iot-devices/time-series/?date_range=7&vendor=n-able&model=n-central&limit=100&group_by=geo&stacking=stacked","observer":"Shadowserver","metric":"exposed"},{"title":"Update on N-central 2026.4 HF2 and ongoing security response","url":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response","observer":"N-able","metric":"vendor-stated"}],"whatChanged":{"date":"2026-11-14","items":[{"text":"CSIRT Italia AL02/261113/CSIRT-ITA (published 13 Nov 2026, 10:42 Italian time) reports active exploitation of CVE-2026-90436 in Apache Axis and notes a public PoC. Original live page is the ACN CSIRT Italia alert. The Toscana CSIRT page is a verified regional mirror. The alert names no victims, sectors, IOCs, or first-seen date. Apache has published no exploitation statement. That CVE's catalog page stays Reported exploited (government: CSIRT Italia, 13 Nov 2026). See the [Apache Axis CVE-2026-90436](/vulns/apache-axis-cve-2026-90436) page. Able2Shell badge stays Reported exploited (huntback).","headline":"CSIRT Italia reports Axis CVE-2026-90436 exploitation; Axis page stays Reported exploited","section":"exploitation","date":"2026-11-14","sourceUrl":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436","alsoSourceUrl":"https://csirt.regione.toscana.it/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436-al02-261113-csirt-ita/","addedDate":"2026-11-14"},{"text":"Rechecked CISA KEV catalog 2026.11.13 (released 2026-11-13T20:24:18.3008Z, 1,781 entries) on 14 Nov 2026: still none of CVE-2026-125883 / 125878 / 125879 / 125880 / 125881 / 125882 / 91000 / 90436. N-able still has no statement naming CVE-2026-90436 and no Able2Shell fix. Axis 1.x still has no fixed release.","headline":"Still not in CISA KEV; N-able still has not named CVE-2026-90436","section":"fixed-versions","date":"2026-11-14","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","addedDate":"2026-11-14"},{"text":"N-able incident 202613 update 13 Nov 2026 03:50:42 UTC: \"Through our ongoing investigation today, we have identified additional Indicators of Compromise (IOCs) and are working closely with those specific customers to assess and mitigate any potential risks.\" This page records that as N-able reporting IoCs at specific customers. It is not a vendor ITW mark for 4EverAble2Shell. The 12 Nov 202613 notice still says N-able has seen no signs of compromise. Badge stays Reported exploited (huntback, 12 Nov 2026). SecurityWeek 13 Nov quotes the same 13 Nov sentence.","headline":"N-able reports IoCs at specific customers; badge stays Reported exploited","section":"exploitation","date":"2026-11-13","sourceUrl":"https://uptime.n-able.com/event/202613/","alsoSourceUrl":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","addedDate":"2026-11-13"},{"text":"Lupovis, quoted by SecurityWeek 13 Nov 2026: the attacker's wallet showed 21 rigs linked to compromised N-central servers in the US (9), South Africa (4), Canada (4), the UK, Germany, France and Sweden. Lupovis: \"Our decoys never execute anything, so none of the listed rigs are ours. Every one is a real server that ran the chain to root.\" Lupovis also said each victim's miner is named after its IP address. That 21 matches huntback's 21 nc_ rigs at 12:50 UTC 12 Nov, already sourced on this page. SecurityWeek: Lupovis and Huntback observed compromise about 5 hours after the PoC. Badge stays Reported exploited.","headline":"Lupovis: 21 miners on real N-central servers; decoys never run payloads","section":"exploitation","date":"2026-11-13","sourceUrl":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","alsoSourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","addedDate":"2026-11-13"},{"text":"SecurityWeek 13 Nov 2026 quotes WatchTowr: \"New N-able zero-days are out, and WatchTowr Intel is already seeing probes for ‘4EverAble2Shell’, which affects builds with the Legacy API enabled.\" That upgrades the earlier THN aggregator citation of the same watchTowr post. Rechecked CISA KEV catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries) on 13 Nov 2026 18:55 SGT: still none of CVE-2026-125883 / 125878 / 125879 / 125880 / 125881 / 125882 / 91000 / 90436. N-able 202613: no fix yet; restricting features including Legacy API and Intune; developing additional remediation. 4EverAble2Shell and Agent2Shell stay mitigations-only.","headline":"watchTowr quoted in SecurityWeek seeing Legacy API probes; still not in KEV","section":"exploitation","date":"2026-11-13","sourceUrl":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","alsoSourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","addedDate":"2026-11-13"},{"text":"N-able incident 202609 (Investigating, started 2026-11-12T07:00:00 UTC) says it is investigating a new public disclosure of additional vulnerabilities in on-premises N-central 2026.4.1 HF2. Initial review: the server issue described depends on Legacy API being turned on and exposed to the public internet. Legacy API is off by default and is not recommended. If it is enabled, disable it now; otherwise confirm it is off. Hosted environments are not affected by this issue. No fix and no CVE are given. The Hacker News maps that server issue to 4EverAble2Shell. Agent2Shell is not named on the incident page, so this page still records no vendor statement yet on Agent2Shell. The 11 Nov HF2 post said all identified unauthenticated issues were addressed; Huntress 12 Nov 1:10 AM ET (static review) said treat even HF2 as vulnerable. That dispute stays above the fold, now with N-able's Legacy API precondition for the server issue.","headline":"N-able investigating on-prem HF2; initial review says Legacy API must be on and exposed","section":"fixed-versions","date":"2026-11-12","sourceUrl":"https://uptime.n-able.com/event/202609/","alsoSourceUrl":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","addedDate":"2026-11-12"},{"text":"Previdian VULN-2026-0009 (published 12 Nov 2026 06:12 UTC / 14:12 SGT; page image stamp 10:05:56 UTC / 18:05 SGT) records two 4EverAble2Shell exploitation attempts from one attacker IP, first seen 12 Nov 2026. Previdian says sensors do not show the target was vulnerable or that the attempt succeeded. The Hacker News, quoting Ryan Dewhurst, reports the same two-attempt picture and says there is no evidence of successful exploitation. THN names the attempted chain as code execution via Apache Axis CVE-2026-90436, then root via 4EverAble2Shell. THN also reports a watchTowr post on X seeing probes for 4EverAble2Shell on builds with Legacy API enabled (direct X fetch failed; cited only via THN). Badge stays Exploitation attempts. Not in CISA KEV catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries, checked 12 Nov 2026 22:55 SGT), including CVE-2026-90436.","headline":"Previdian reports two 4EverAble2Shell attempts; no evidence of success; not in KEV","section":"exploitation","date":"2026-11-12","sourceUrl":"https://previdian.com/VULN-2026-0009","alsoSourceUrl":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","addedDate":"2026-11-12"},{"text":"N-able 12 Nov: on-premises customers should disable Legacy API now if it is enabled, and confirm it is off otherwise. Huntress 12 Nov 1:10 AM ET still says take even HF2 servers offline or cut all internet access, and not to rely on IP allowlisting, because Agents and Probes check in on the same affected endpoints. That Huntress take-offline advice still stands for Agent2Shell until a fix, because the vendor Legacy API statement does not clearly cover Agent2Shell. Hosted: N-able says hosted environments are not affected by this server issue; watch incident 202609.","headline":"Disable Legacy API now; Huntress take-offline advice still stands for Agent2Shell","section":"overview","date":"2026-11-12","sourceUrl":"https://uptime.n-able.com/event/202609/","alsoSourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","addedDate":"2026-11-12"},{"text":"New catalog page for Able2Shell, the N-able N-central exploit chains disclosed 8-9 Nov 2026.","headline":"New catalog page for Able2Shell N-central exploit chains","section":"overview","date":"2026-11-11","addedDate":"2026-11-11","kind":"page"},{"text":"Added Am I affected checks, mitigations and response guidance","headline":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected","date":"2026-11-11","addedDate":"2026-11-11","kind":"page"},{"text":"N-able uptime event 202584 update timestamped 2026-11-11 01:04 UTC: all hosted N-central servers (NCODs) across all global regions have been successfully upgraded. BleepingComputer (Sergiu Gatlan, 11 Nov 2026) reports that update. On-premises customers should still upgrade to 2026.4 HF2 build 2026.4.1.26 as soon as possible and keep servers offline until the upgrade is complete. All customers, hosted and on-premises, must upgrade Agents first, then Probes. A Probe on 2026.4.1.26 cannot talk to an Agent or PME that is not also on 2026.4.1.26. Built-in remote control remains temporarily disabled; Take Control still works.","headline":"Hosted NCOD servers upgraded in all regions; on-prem still upgrade ASAP","section":"fixed-versions","date":"2026-11-11","sourceUrl":"https://uptime.n-able.com/event/202584/","alsoSourceUrl":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/","addedDate":"2026-11-11"},{"text":"Defused (10 Nov 2026, 15:32 UTC) reported targeted probing of N-central after the public drop: opening of anonymous agent sessions, pulling appliance config, and hitting the remote-control endpoint without auth. BleepingComputer (11 Nov 2026) quotes that post and says N-able has yet to flag these flaws as exploited in the wild. Badge stays Exploitation attempts. None of the seven HF2 CVEs are in CISA KEV catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries, checked 11 Nov 2026).","headline":"Defused reports targeted probing; badge stays Exploitation attempts; not in KEV","section":"exploitation","date":"2026-11-11","sourceUrl":"https://x.com/DefusedCyber/status/2120177846970691916","alsoSourceUrl":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/","addedDate":"2026-11-11"},{"text":"BleepingComputer (Sergiu Gatlan, 11 Nov 2026) citing Shadowserver: just over 148 N-central servers currently exposed online, a sharp decrease from the 1,338 detected on Monday (9 Nov 2026). Those are exposure counts, not vulnerable or compromise counts. This page uses BleepingComputer's numbers. The Shadowserver IoT time-series dashboard is linked as context only and was not live-scraped for this update.","headline":"Shadowserver exposure fell from 1,338 on 9 Nov to just over 148","section":"exploitation","date":"2026-11-11","sourceUrl":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/","alsoSourceUrl":"https://dashboard.shadowserver.org/statistics/iot-devices/time-series/?date_range=7&vendor=n-able&model=n-central&limit=100&group_by=geo&stacking=stacked","addedDate":"2026-11-11"}]},"whatTheBugIs":"14 Nov 2026. CSIRT Italia AL02/261113/CSIRT-ITA (published 13 Nov 2026, 10:42 Italian time) reports active exploitation of CVE-2026-90436 in Apache Axis and notes a public PoC. Original on the ACN CSIRT Italia page; Toscana CSIRT is a verified regional mirror. The alert names no victims, sectors, IOCs, or first-seen date. Apache has published no exploitation statement. That CVE's catalog page stays Reported exploited (government: CSIRT Italia, 13 Nov 2026). See [Apache Axis CVE-2026-90436](/vulns/apache-axis-cve-2026-90436). Able2Shell badge stays Reported exploited (huntback). Rechecked CISA KEV catalog 2026.11.13 (1,781 entries) on 14 Nov 2026: still not listed, including CVE-2026-90436. N-able still has no statement naming that CVE.\n\nEvening 13 Nov 2026. N-able incident 202613 JSON fetched (status Identified, start 2026-11-12T16:00:00 UTC). Update timestamped 2026-11-13T03:50:42 UTC: \"Through our ongoing investigation today, we have identified additional Indicators of Compromise (IOCs) and are working closely with those specific customers to assess and mitigate any potential risks.\" This page records that as N-able reporting IoCs at specific customers. It is not a vendor ITW mark for 4EverAble2Shell. The 12 Nov 202613 description still says: \"Importantly, we have seen no signs of compromise. We are continuing to monitor closely and will provide updates as needed.\" SecurityWeek 13 Nov quotes the same 13 Nov IoC sentence and links that incident. Lupovis, quoted by SecurityWeek: 21 rigs on compromised N-central servers in the US (9), South Africa (4), Canada (4), the UK, Germany, France and Sweden. Lupovis: \"Our decoys never execute anything, so none of the listed rigs are ours. Every one is a real server that ran the chain to root.\" That 21 matches huntback's 21 nc_ rigs already on this page. SecurityWeek quotes WatchTowr seeing probes for 4EverAble2Shell on builds with Legacy API enabled. N-able 202613: no fix yet; Legacy API off by default; Intune turned off on hosted and temporarily deactivated on-prem; developing additional remediation. Rechecked CISA KEV catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries) on 13 Nov 2026 18:55 SGT: still not listed, including CVE-2026-90436. Badge stays Reported exploited.\n\n13 Nov 2026. huntback Research published 12 Nov 2026 the first public third-party report of successful in-the-wild 4EverAble2Shell use on production N-central servers, including 2026.4 HF2 build 2026.4.1.26. Weaponised requests from 09:16 UTC 12 Nov (17:16 SGT), about five hours after huntback's 03:58 UTC public-PoC timestamp; by 12:50 UTC (20:50 SGT) the operator's public mining pool listed 21 rigs named nc_, all serving N-central login pages, 19 reporting 2026.4.1.26, and huntback also names one on 2025.3.1.9. Outcome: an XMRig Monero miner running as root. huntback: the chain started with Apache Axis code execution as the nable user, then local root, then the miner installer. huntback does not print a CVE ID for that Axis step. THN (12 Nov) named Apache Axis CVE-2026-90436 as the first step of the Previdian-observed attempt chain; this page names that CVE only because THN does, and does not treat huntback as having assigned it. Badge: Reported exploited. N-able has not confirmed huntback's mining report. N-able 12 Nov incident 202609: the server issue depends on Legacy API being on and exposed; Legacy API is off by default; keep it disabled; hosted not affected by this issue; no fix yet. The Hacker News 12 Nov, quoting Dewhurst, still said there is no evidence of successful exploitation as of writing, so THN is not used here as corroboration of huntback's success claim. Not in CISA KEV (catalog 2026.11.10, 1,779 entries, checked 13 Nov 2026 18:55 SGT) for the seven HF2 CVEs or CVE-2026-90436.\n\nEvening 12 Nov 2026. N-able incident 202609 (status Investigating, start 2026-11-12T07:00:00 UTC, timezone UTC on the dashboard) says N-able is investigating a new public disclosure containing claims of additional vulnerabilities in N-central On-Premises 2026.4.1 HF2. Verbatim from that incident: Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet. Legacy API is turned off by default in the product and is not recommended. On-premises: if Legacy API is enabled, disable it now (N-able links a login how-to); all other customers should confirm it is disabled. Hosted environments are not affected by this issue. N-able says its Security and Engineering teams are assessing the claims, including which versions may be in scope, and will share findings on that page. The incident names on-prem Americas, APAC, and Europe. It does not name 4EverAble2Shell or Agent2Shell, does not publish a fix build, and does not assign a CVE.\n\nThe Hacker News (Ravie Lakshmanan, 12 Nov 2026) quotes that incident and maps the new shortcomings to 4EverAble2Shell and Agent2Shell, repeating the researcher's claim that the published PoCs work against 2026.4 HF2 build 2026.4.1.26. THN: 4EverAble2Shell is unauthenticated remote code execution with root on the server; Agent2Shell uses more than ten issues to run commands on managed Windows agents as NT AUTHORITY\\SYSTEM if the attacker knows the target appliance ID. This page treats the N-able Legacy API statement as covering the server issue / 4EverAble2Shell only. Agent2Shell still has no vendor statement.\n\nPrevidian VULN-2026-0009, published 12 Nov 2026 06:12 UTC (14:12 SGT) and with a page-image cache stamp 10:05:56 UTC (18:05 SGT), describes an unauthenticated 4EverAble2Shell chain reported to reach root, tested by the researcher against Appliance 2026.4.1.26 (HF2). Previdian: complete affected-version range and a fixed build have not been verified. Public sensor card: 2 attempts, 1 unique attacker IP, 1 country (IN), first and last observed 12 Nov 2026. Previdian says those observations are attempts and do not show that the target was vulnerable or that the attempt succeeded. The public page does not list the IP.\n\nTHN quoting Dewhurst: targeted probing against 4EverAble2Shell within hours of the PoC, source IP 157.20.241[.]16, no evidence of successful exploitation as of writing. Attempted chain in that report: initial code execution through Apache Axis CVE-2026-90436 (CVSS 9.8, patches 6 Nov 2026 per THN), then privilege to root using 4EverAble2Shell, then a shell script fetched with curl from that IP. CVE-2026-90436 is stated here only because THN names it verbatim; it is not an Able2Shell CVE on this page. THN also reports watchTowr seeing probes for 4EverAble2Shell on Legacy-API-enabled builds.\n\n12 Nov 2026. Huntress posted an update at 1:10 AM ET that day. Late on 11 Nov, the Able2Shell researcher released two further public chains against N-able N-central: 4EverAble2Shell and Agent2Shell. Huntress records the researcher's claim that both still work on 2026.4 HF2 build 2026.4.1.26. Huntress's first look was a static review of the published code, not a live exploit run. 4EverAble2Shell, per that review, is unauthenticated remote code execution that ends as root on the N-central server and does not need credentials. Agent2Shell is a set of more than ten problems in server-to-Windows Agent and Probe communication. Two of those paths, Huntress says, let an unauthenticated attacker who can reach the server run commands on managed Windows endpoints, including as SYSTEM. Combined, Huntress says an attacker could start at an internet-facing N-central server and continue onto the endpoints that server manages. Huntress says operators should treat a fully patched N-central server as still vulnerable. Huntress also says no fix was available when that update was written.\n\nDispute on whether HF2 closed unauthenticated issues. On 11 Nov 2026 N-able published a follow-up on 2026.4 HF2. In our words: N-able said it had addressed every identified issue that an unauthenticated user could exploit, that leftover issues need a signed-in N-central account (often a privileged one) or other limits on exploitability, and that more hotfixes are coming. Huntress's 12 Nov write-up describes new unauthenticated chains that the researcher says still work on HF2. This page records that disagreement above the fold. As of the morning 12 Nov Huntress update there was no vendor statement yet on 4EverAble2Shell or Agent2Shell by those names. Evening 12 Nov: N-able incident 202609 is a vendor statement on the on-prem server issue and Legacy API, which THN maps to 4EverAble2Shell; Agent2Shell still has no vendor statement. Huntress 12 Nov, N-able 11 Nov, and incident 202609 do not assign CVE IDs for those chains. The seven published HF2 CVEs remain the IDs for builds older than 2026.4.1.26.\n\nAble2Shell is the public name for a set of N-able N-central findings published by independent researcher Sean Bales (Huntress 9 Nov 2026; SecurityWeek, The Hacker News, and CSO Online 10 Nov 2026; BleepingComputer 11 Nov 2026). Huntress, Rapid7, and the public Able2Shell README describe 33 findings and four exploit chains. N-able's 2026.4 HF2 notes list seven CVEs for the hotfix. CSO Online (Lucian Constantin, 10 Nov 2026): N-able has not confirmed how many of the 33 flaws it could reproduce, but the new hotfix lists 7 CVEs. BleepingComputer (11 Nov 2026): HF2 has patches for some of the leaked zero-days, including the most critical, and lists those seven CVEs. BleepingComputer's earlier article described more than 30 alleged zero-days. N-able uptime event 202584: a follow-up hotfix will be released to provide further security updates. This page does not republish exploit code, payloads, endpoints, or reproduction steps.\n\nLead CVE and CVSS. N-able CNA published CVE-2026-125883 on 10 Nov 2026 at 21:19:11.273Z (state PUBLISHED): Multiple XXE Vulnerabilities, CWE-611, CAPEC-146 XML Schema Poisoning. Description: Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1. CVSS 4.0 9.3 Critical, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. This is the primary CVE on this page because it matches the unauthenticated XXE lead chain. Official vendor advisories are on me.n-able.com (login). NVD HTML detail page timed out when fetched 11 Nov 2026; an NVD listing showed Received, no NVD-produced Primary. FIRST EPSS returned total 0 for this CVE and the six siblings (checked 11 Nov 2026).\n\nSibling CVEs in the same HF2 (N-able CNA, all PUBLISHED 10 Nov 2026, affected N-central before 26.4.1 unless noted; descriptions and CVSS 4.0 scores below match the CNA records fetched 11 Nov 2026). CVE-2026-125878 CNA description: Improper neutralization of input during web page generation (cross-site scripting) vulnerability in N-able N-central allows Resource Injection. CWE-79, CVSS 4.0 8.7 High, PR:L, published 21:22:40.630Z. CNA title, HF2 notes, and BleepingComputer list this ID as Multiple OGNL Injection vulnerabilities, so the CVE description and those titles differ. CVE-2026-125879 CNA description: Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. CNA title: Local privilege escalation to root via nable-writable syslog-ng config. CWE-266, CVSS 4.0 8.6 High, PR:H, published 21:23:18.540Z. CVE-2026-125880 CNA description: Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS). CNA title: Stored XSS via MMS3 patch metadata (admin context). CWE-644, CVSS 4.0 8.3 High, PR:H UI:A, published 21:26:05.050Z. CVE-2026-125881 CNA description: Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. CNA title: Schema-hint SSRF via service import schema validation. CWE-918, CVSS 4.0 9.3 Critical, PR:N, published 21:24:33.606Z. CVE-2026-125882 CNA description: Relative path traversal vulnerability in N-able N-central allows Path Traversal. CNA title: RCE via file repository upload path traversal. CWE-23, CVSS 4.0 8.6 High, PR:H, finder Nate Fair, Sprocket Security, published 21:25:23.173Z. CVE-2026-91000 CNA description: Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. CNA title: Insecure IPC Channels lead to local privilege escalation. CWE-306, CVSS 4.0 8.4 High, AV:L PR:L, CNA affected before 2026.4.1 (not 26.4.1), published 21:19:57.597Z. These IDs are aliases on this page, not separate catalog pages.\n\nLead chain, from Rapid7 (10 Nov 2026) and the researcher README: unauthenticated XML external entity (XXE) in service import, trusted-session takeover, administrator, command execution as the nable service account. Huntress: successful use of the RMM can reach managed endpoints. The README also says that chain can create an enabled Default Administrator account. Conceptual impact class only.\n\nOther chains, from Rapid7: an administrator viewing malicious patch metadata, or ProductAdmin credentials. Huntress: three of the four chains reach remote code execution as the nable service account or root; one is local privilege escalation to root. The README titles those four chains at a high level (anonymous service-import XXE to nable RCE; anonymous stored XSS to OGNL nable RCE; anonymous stored XSS to Audit Export root RCE; SIS traversal then syslog helper to root). This page does not expand those titles into steps.\n\nFixed version for the seven HF2 CVEs. N-able N-central 2026.4 HF2 Release Notes (posted 10 Nov 2026, Last Updated 10 Nov 2026): Build Number 2026.4.1.26. Huntress UPDATE 10 Nov 5:30 PM ET: On November 10, N-able released N-central 2026.4 HF2, (build 2026.4.1.26). Huntress UPDATE 12 Nov 2026 1:10 AM ET: that build is not a complete fix for 4EverAble2Shell or Agent2Shell; treat even a fully patched server as vulnerable, and no fix was available then. CNA records say before 26.4.1 (CVE-2026-91000: before 2026.4.1). This page uses the vendor build 2026.4.1.26 as the fix for the seven HF2 CVEs and notes the CNA version string. Rapid7's Emergency Threat Response (last updated 10 Nov 2026, Initial publication) still says N-able's notice does not yet include CVE identifiers or a remediation build; that article is stale against the vendor notes.\n\nHosted N-central. HF2 notes: If you are on an N-central hosted instance (NCOD), N-able will upgrade your server for you. You do not need to upgrade your server. You must still upgrade your Agents and Probes. Huntress 12 Nov 2026: hosted servers run the same 2026.4.1.26 build as on-prem HF2, so watch N-able's status page for guidance on the new chains. That is not a vendor statement on 4EverAble2Shell or Agent2Shell. N-able uptime event 202584 update timestamped 2026-11-11 01:04 UTC: All Hosted N-central servers (NCODs) across all global regions have been successfully upgraded. BleepingComputer (11 Nov 2026) reports that update. Huntress UPDATE 10 Nov 5:30 PM ET had already said N-able updated all hosted N-central servers and brought them back online. The earlier outage: Huntress incident opened 9 Nov 2026 at 15:15 UTC. The Hacker News quotes N-able on the precautionary hosted outage. Ecoverse services under N-able Login remaining available (The Hacker News quoting N-able) is not an N-central restore.\n\nOn-prem. HF2 notes: customers running on-premises N-central deployments should upgrade their servers as soon as possible. Huntress UPDATE 10 Nov: keep them offline until the upgrade is complete. Huntress UPDATE 12 Nov 2026 1:10 AM ET: take the server offline again, or remove all internet access, even if 2026.4 HF2 is already installed, and keep it offline until N-able issues guidance for the new chains. Huntress: do not rely on IP allowlisting alone, because Agents and Probes check in on the same affected endpoints. Supported upgrade paths to 2026.4.1.26: 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1 to Hotfix 4, 2026.4 build 2026.4.0.27, 2026.4 Hotfix 1 build 2026.4.0.32. Earlier: No, upgrade to a supported version first (HF2 notes). That is a path constraint, not a not-affected statement.\n\nAgents and Probes. HF2 notes: All customers, both hosted and on-premises, must upgrade their Agents and Probes. Upgrade Agents first, then Probes. Compatibility: a Probe not yet on 2026.4.1.26 still talks to Agents as today; a Probe on 2026.4.1.26 cannot talk to an Agent or PME that is not also on 2026.4.1.26. Known issue: built-in remote control is temporarily disabled; Take Control continues to work.\n\nExploitation. Huntress UPDATE 12 Nov 2026 1:10 AM ET: potential indicators for the new chains were taken from static code review and none have been observed in the wild. Huntress UPDATE 10 Nov 2026 5:30 PM ET quotes N-able on scanning associated with the published PoC and no evidence of successful customer exploitation, and says Huntress has not observed evidence of Able2Shell exploitation in partner environments. N-able 11 Nov 2026 HF2 follow-up: scanning associated with the public proof-of-concept, and no indications of compromise within hosted N-central servers. Rapid7 (10 Nov 2026) recorded the same N-able scanning statement. The Hacker News (10 Nov 2026) reports watchTowr honeypot attempts overnight after the drop. CSO Online (10 Nov 2026) cites Previdian: 68 exploitation attempts against one honeypot from a single IP within about 18 hours of publication; the article does not publish the IP. Defused (10 Nov 2026 15:32 UTC), quoted by BleepingComputer (11 Nov 2026): probing of N-central for the publicly dropped zero-days, including anonymous agent sessions, appliance config pulls, and unauthenticated hits on the remote-control endpoint. BleepingComputer: N-able has yet to flag these flaws as exploited in the wild. Page badge from 13 Nov 2026: Reported exploited (huntback 12 Nov mining report), not vendor-confirmed. Never a not-exploited mark.\n\nExposure. BleepingComputer (11 Nov 2026) citing Shadowserver: just over 148 internet-exposed N-central servers on 11 Nov, down from 1,338 on Monday 9 Nov. CSO Online (10 Nov 2026) citing Censys: 1,728 internet-exposed instances. Those are different scanners and dates. Exposure counts, not vulnerable or compromise counts.\n\nKEV. Not in CISA KEV (catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries, checked 13 Nov 2026 18:55 SGT) for CVE-2026-125883 or the six siblings. Prior N-central rows in that same catalog (CVE-2026-86218, CVE-2026-18556, CVE-2026-18577) are separate 2026 incidents; this page does not treat them as Able2Shell.\n\nThis incident is separate from earlier 2026 N-central CVEs that Huntress tracked: CVE-2026-18556 and CVE-2026-18577 (August), CVE-2026-86218 (September, exploited pre-auth RCE), and Huntress's own CVE-2026-86206 / CVE-2026-86207 chain. Those IDs were verified in CISA KEV catalog 2026.11.10 for 86218 / 18556 / 18577 only; 86206 and 86207 are Huntress-named and are not KEV-listed. No existing vuln2shell pages cover those CVEs.\n\nCredit: Sean Bales (SecurityWeek, The Hacker News, CSO Online). CVE-2026-125882 finder: Nate Fair, Sprocket Security (CNA record and HF2 notes). Huntress byline: Lindsey O'Donnell-Welch and Susannah Matt (9 Nov 2026, updated 12 Nov 2026 1:10 AM ET).\n\nThe Apache Axis CVE named in that chain is on the [Apache Axis CVE-2026-90436](/vulns/apache-axis-cve-2026-90436) page.","attackPath":{"caption":"High-level only. Not a reproduction guide. No payloads, endpoints, or commands.","steps":[{"id":"reach","label":"Reach N-central","detail":"Network access to an N-central server. Huntress 12 Nov 2026: even a 2026.4 HF2 server should be treated as vulnerable to the new chains. On-prem servers that stay on the internet remain in this step."},{"id":"app","label":"Service-import XXE","detail":"Original Able2Shell lead chain: unauthenticated XML external entity handling in service import (Rapid7; researcher README). Conceptual class only. Still relevant to builds before 2026.4 HF2."},{"id":"exploit","label":"Unauth root on server","detail":"4EverAble2Shell (Huntress 12 Nov 2026, static review of published code): unauthenticated remote code execution to root on the N-central server, no credentials. N-able 12 Nov initial review: the server issue depends on Legacy API being on and exposed to the internet; Legacy API is off by default. huntback 12 Nov: on production servers the chain started with Apache Axis code execution as nable, then local root, then an XMRig miner. Conceptual class only. Not a reproduction guide."},{"id":"exec","label":"Server to Windows endpoints","detail":"Agent2Shell (Huntress 12 Nov 2026): two chains let an unauthenticated attacker who can reach the server run commands on managed Windows endpoints, including as SYSTEM. Conceptual class only."},{"id":"shell","label":"Internet server to managed estate","detail":"Huntress 12 Nov 2026: used together, these could move from an internet-facing N-central server to the endpoints it manages. Original Able2Shell coverage also treated N-central as an RMM whose compromise puts managed environments at risk. Conceptual impact only."}]},"exploitation":{"kev":{"listed":false,"date":"2026-11-10","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 14 Nov 2026) against catalog 2026.11.13 (released 2026-11-13T20:24:18.3008Z, 1,781 entries) for CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, CVE-2026-91000, or CVE-2026-90436. Huntress 12 Nov, N-able 11 Nov, incident 202609, and incident 202613 do not assign CVE IDs for 4EverAble2Shell or Agent2Shell. CVE-2026-90436 is named by THN as attempted initial access in the Previdian chain; huntback names Apache Axis as the first step of the successful mining chain but does not print that CVE. CSIRT Italia AL02/261113 (13 Nov 2026) reports active exploitation of CVE-2026-90436; Apache has published no exploitation statement; that CVE's page stays Reported exploited. The same catalog still lists separate N-central incidents CVE-2026-86218, CVE-2026-18556, and CVE-2026-18577."},"firstSeen":{"date":"2026-11-12","source":"huntback","note":"huntback Research, 12 Nov 2026: first public third-party report of successful 4EverAble2Shell use on production N-central, including 2026.4 HF2 build 2026.4.1.26. Weaponised from 09:16 UTC 12 Nov; 21 nc_ miners at 12:50 UTC, 19 on HF2; XMRig as root. Lupovis (via SecurityWeek, 13 Nov) reports the same 21 and says its decoys never run payloads. N-able 13 Nov reports additional IoCs at specific customers; that is not a vendor ITW mark. CSIRT Italia AL02/261113 (13 Nov 2026) reports active exploitation of CVE-2026-90436 (the Axis stage); Apache has published no exploitation statement. Able2Shell badge: Reported exploited. Not in CISA KEV (checked 14 Nov 2026).","dateLabel":"Reported exploited (third-party)"},"vendorStatements":[{"vendor":"N-able","date":"2026-11-09","statement":"As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the environment and implement appropriate remediation.","url":"https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html","retracted":false},{"vendor":"N-able","date":"2026-11-10","statement":"If you are on an N-central hosted instance (NCOD), N-able will upgrade your server for you. You do not need to upgrade your server. You must still upgrade your Agents and Probes.","url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","retracted":false},{"vendor":"N-able","date":"2026-11-10","statement":"To keep your environment protected, customers running on-premises N-central deployments should upgrade their servers as soon as possible. Hosted N-central servers are upgraded by N-able. All customers, both hosted and on-premises, must upgrade their Agents and Probes.","url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","retracted":false},{"vendor":"N-able","date":"2026-11-10","statement":"As of November 10, N-able reported scanning activity associated with the published PoC code and said it had no evidence that any customer environment had been successfully exploited.","url":"https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown/","retracted":false},{"vendor":"N-able","date":"2026-11-11","statement":"All Hosted N-central servers (NCODs) across all global regions have been successfully upgraded.","url":"https://uptime.n-able.com/event/202584/","retracted":false},{"vendor":"N-able","date":"2026-11-11","statement":"N-able said all identified issues that an unauthenticated user could exploit have been addressed, leftover issues need an authenticated N-central account often with elevated privileges or other limiting conditions, later hotfixes will follow, scanning tied to the public proof-of-concept has been seen, and hosted N-central servers show no indications of compromise.","url":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response","retracted":false},{"vendor":"N-able","date":"2026-11-12","statement":"Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet. Legacy API is turned off by default in the product and is not recommended.","url":"https://uptime.n-able.com/event/202609/","retracted":false},{"vendor":"N-able","date":"2026-11-12","statement":"N-able N-central Hosted Customers: Hosted environments are not affected by this issue.","url":"https://uptime.n-able.com/event/202609/","retracted":false},{"vendor":"N-able","date":"2026-11-12","statement":"Importantly, we have seen no signs of compromise. We are continuing to monitor closely and will provide updates as needed.","url":"https://uptime.n-able.com/event/202613/","retracted":false},{"vendor":"N-able","date":"2026-11-13","statement":"Through our ongoing investigation today, we have identified additional Indicators of Compromise (IOCs) and are working closely with those specific customers to assess and mitigate any potential risks.","url":"https://uptime.n-able.com/event/202613/","retracted":false}],"attributionDispute":"N-able has not confirmed huntback's 4EverAble2Shell in-the-wild mining report. N-able 13 Nov (incident 202613 update 03:50:42 UTC) reports additional IoCs at specific customers; that is not a vendor ITW mark. N-able 12 Nov on the same incident: no signs of compromise. N-able 12 Nov incident 202609: the server issue depends on Legacy API being on and exposed; Legacy API is off by default; keep it disabled; no fix yet."},"timeline":[{"date":"2026-11-08","event":"Able2Shell public disclosure. SecurityWeek (10 Nov 2026) says Sean Bales published the bugs on GitHub on Sunday (8 Nov 2026). Huntress tells defenders to review login and authentication activity from 8 Nov onward. GitHub commit 77e8fb6 on Oracle-Security/CVEs is timestamped 2026-11-09T04:14:21Z.","source":{"title":"N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days","url":"https://www.securityweek.com/n-able-takes-n-central-offline-as-researcher-drops-over-30-zero-days/","publisher":"SecurityWeek"},"kind":"poc","key":true,"addedDate":"2026-11-11"},{"date":"2026-11-09T15:15:00Z","event":"N-able took hosted N-central environments offline. Huntress: incident opened 9 Nov 2026 at 15:15 UTC. Huntress: N-able said it has not seen active exploitation as of that timestamp, and on-prem customers should take servers offline until further notice.","source":{"title":"N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","publisher":"Huntress"},"kind":"vendor","key":true,"addedDate":"2026-11-11"},{"date":"2026-11-09","event":"Huntress published its Able2Shell tracker. 33 findings, four chains, three RCE plus one privilege escalation to root. Tested on N-central Appliance 2026.4.0.31 and likely earlier. Hunting from 8 Nov.","source":{"title":"N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","publisher":"Huntress"},"kind":"other","addedDate":"2026-11-11"},{"date":"2026-11-10","event":"Rapid7 Emergency Threat Response (initial publication, last updated 10 Nov 2026): no CVE or CVSS in N-able's then-current notice; no remediation build yet; hotfix ETA midday 10 Nov 2026 EST; N-able reported scanning associated with the PoC and no evidence of successful customer exploitation. That Rapid7 page was not updated after HF2 shipped.","source":{"title":"Critical vulnerabilities in N-able N-central prompt hosted shutdown","url":"https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown/","publisher":"Rapid7"},"kind":"advisory","addedDate":"2026-11-11"},{"date":"2026-11-10","event":"SecurityWeek (4:56 AM ET) and The Hacker News report the outage and hotfix validation. The Hacker News update 10 Nov 2026 5:42 p.m. UTC: validating activities ongoing. watchTowr honeypot attempts and Defused probing reported via The Hacker News.","source":{"title":"N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits","url":"https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html","publisher":"The Hacker News"},"kind":"other","addedDate":"2026-11-11"},{"date":"2026-11-10","event":"N-able shipped N-central 2026.4 HF2, build 2026.4.1.26. Release notes posted 10 Nov 2026, Last Updated 10 Nov 2026. Lists the seven CVEs. Hosted NCOD: N-able upgrades the server; customers still upgrade Agents and Probes. On-prem: upgrade ASAP. Known issue: built-in remote control temporarily disabled; Take Control still works.","source":{"title":"N-central 2026.4 HF2 Release Notes","url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","publisher":"N-able"},"kind":"patch","key":true,"addedDate":"2026-11-11"},{"date":"2026-11-10","event":"N-able CNA published seven CVEs (CVE-2026-125883 lead XXE CVSS 4.0 9.3 Critical, plus 125878, 125879, 125880, 125881, 125882, and 91000). datePublished between 2026-11-10T21:19:11.273Z and 2026-11-10T21:26:05.050Z. Vendor advisory URLs are on me.n-able.com (login).","source":{"title":"CVE-2026-125883 (N-able CNA)","url":"https://cveawg.mitre.org/api/cve/CVE-2026-125883","publisher":"N-able CNA"},"kind":"advisory","key":true,"addedDate":"2026-11-11"},{"date":"2026-11-10","event":"Huntress UPDATE 10 Nov 2026 5:30 PM ET: hosted servers upgraded and brought back online; on-prem upgrade ASAP and stay offline until complete; Agents and Probes required for hosted and on-prem. Still quotes N-able scanning and no evidence of successful customer exploitation. Huntress has not observed partner-environment exploitation.","source":{"title":"N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","publisher":"Huntress"},"kind":"vendor","key":true,"addedDate":"2026-11-11"},{"date":"2026-11-10","event":"CSO Online (Lucian Constantin): HF2 shipped; Censys 1,728 internet-exposed N-central instances; Previdian 68 honeypot attempts from a single unpublished IP within about 18 hours of publication. N-able has not confirmed how many of the 33 flaws it could reproduce; hotfix lists 7 CVEs.","source":{"title":"N-able N-central gets emergency fix two days after 33 exploits published","url":"https://www.csoonline.com/article/4247028/n-able-n-central-gets-emergency-fix-two-days-after-33-exploits-published.html","publisher":"CSO Online"},"kind":"other","addedDate":"2026-11-11"},{"date":"2026-11-10","event":"Not in CISA KEV. Catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries, checked 11 Nov 2026. None of CVE-2026-125883 / 125878 / 125879 / 125880 / 125881 / 125882 / 91000 are listed. Prior N-central KEV rows 86218 / 18556 / 18577 remain separate incidents.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","key":true,"addedDate":"2026-11-11"},{"date":"2026-11-10T15:32:44Z","event":"Defused reported targeted probing of N-central after the public drop: anonymous agent sessions, appliance config pulls, and unauthenticated hits on the remote-control endpoint. BleepingComputer (11 Nov 2026) quotes that post and says N-able has yet to flag these flaws as exploited in the wild.","source":{"title":"Defused on N-central probing","url":"https://x.com/DefusedCyber/status/2120177846970691916","publisher":"Defused"},"kind":"reported","key":true,"addedDate":"2026-11-11"},{"date":"2026-11-11T01:04:27Z","event":"N-able uptime event 202584: all hosted N-central servers (NCODs) across all global regions have been successfully upgraded. On-premises customers should still upgrade as soon as possible.","source":{"title":"N-able incident 202584","url":"https://uptime.n-able.com/event/202584/","publisher":"N-able"},"kind":"vendor","key":true,"addedDate":"2026-11-11"},{"date":"2026-11-11","event":"BleepingComputer (Sergiu Gatlan): HF2 lists seven CVEs; hosted NCODs upgraded in all regions; Defused probing; Shadowserver exposure just over 148 on 11 Nov, down from 1,338 on Monday 9 Nov. Rechecked: none of the seven CVEs are in CISA KEV catalog 2026.11.10 (1,779 entries).","source":{"title":"N-able releases security hotfixes for zero-day vulnerabilities","url":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/","publisher":"BleepingComputer"},"kind":"other","addedDate":"2026-11-11"},{"date":"2026-11-11","event":"N-able published a follow-up on 2026.4 HF2: it said all identified unauthenticated issues had been addressed, leftover issues need an authenticated (often privileged) account or other limits, and further hotfixes will follow. It also recorded scanning tied to the public proof-of-concept and no indications of compromise on hosted N-central servers.","source":{"title":"Update on N-central 2026.4 HF2 and ongoing security response","url":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response","publisher":"N-able"},"kind":"vendor","key":true,"addedDate":"2026-11-12"},{"date":"2026-11-11","event":"Late on 11 Nov 2026 the Able2Shell researcher published two more public chains, 4EverAble2Shell and Agent2Shell. Huntress (12 Nov 2026 1:10 AM ET) reports that disclosure and the researcher's claim that both work against 2026.4 HF2 build 2026.4.1.26.","source":{"title":"N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","publisher":"Huntress"},"kind":"poc","key":true,"addedDate":"2026-11-12"},{"date":"2026-11-12","event":"Huntress UPDATE 12 Nov 2026 1:10 AM ET: static review of the new published code. 4EverAble2Shell: unauthenticated RCE to root, no credentials. Agent2Shell: more than ten server-to-Windows Agent and Probe issues; two chains let an unauthenticated attacker who can reach the server run commands on managed Windows endpoints, including as SYSTEM. Treat even a fully patched server as vulnerable. No fix yet. On-prem: take offline or cut internet access even with HF2. Indicators from static review; none observed in the wild.","source":{"title":"N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","publisher":"Huntress"},"kind":"other","key":true,"addedDate":"2026-11-12"},{"date":"2026-11-12","event":"Rechecked 12 Nov 2026 22:55 SGT: none of CVE-2026-125883 / 125878 / 125879 / 125880 / 125881 / 125882 / 91000, and not CVE-2026-90436, are in CISA KEV catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries). Incident 202609 still assigns no CVE for 4EverAble2Shell or Agent2Shell.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-12"},{"date":"2026-11-12T07:00:00Z","event":"N-able incident 202609: investigating claims of additional vulnerabilities in on-premises N-central 2026.4.1 HF2. Initial review: the server issue depends on Legacy API being on and exposed to the internet; Legacy API is off by default; disable it now if enabled; hosted not affected by this issue. No fix and no CVE in that incident.","source":{"title":"N-able incident 202609","url":"https://uptime.n-able.com/event/202609/","publisher":"N-able"},"kind":"vendor","key":true,"addedDate":"2026-11-12"},{"date":"2026-11-12","event":"Previdian VULN-2026-0009: two 4EverAble2Shell exploitation attempts from one attacker IP, first seen 12 Nov 2026. Previdian says sensors do not show success. Published 06:12 UTC (14:12 SGT); page image stamp 10:05:56 UTC (18:05 SGT).","source":{"title":"VULN-2026-0009 Exploitation Attempts Observed","url":"https://previdian.com/VULN-2026-0009","publisher":"Previdian"},"kind":"reported","key":true,"addedDate":"2026-11-12"},{"date":"2026-11-12","event":"The Hacker News reports N-able's Legacy API precondition, Previdian's two attempts and no evidence of success, names CVE-2026-90436 as the attempted Apache Axis step, and reports watchTowr probes against Legacy-API-enabled builds.","source":{"title":"New N-central Exploits Work Against Patched Servers","url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","publisher":"The Hacker News"},"kind":"reported","key":true,"addedDate":"2026-11-12"},{"date":"2026-11-12","event":"huntback Research reports successful 4EverAble2Shell use on live N-central, including 2026.4.1.26: weaponised from 09:16 UTC, 21 nc_ miners at 12:50 UTC, 19 on HF2, XMRig as root. Third-party report, not vendor-confirmed.","source":{"title":"4EverAble2Shell is already mining Monero on live N-central servers","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","publisher":"huntback"},"kind":"reported","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-12T16:00:00Z","event":"N-able incident 202613 (Identified, start 2026-11-12T16:00:00 UTC): restricting N-central features and integrations while remediation is completed. Quote: we have seen no signs of compromise. Hosted: Legacy API off by default; Intune turned off as a precaution; no server-side action required; keep upgrading Agents and Probes. On-prem: keep Legacy API disabled; Intune temporarily deactivated; continue HF2 Agent/Probe guidance. Developing additional remediation.","source":{"title":"N-able incident 202613","url":"https://uptime.n-able.com/event/202613/","publisher":"N-able"},"kind":"vendor","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-13T03:50:42Z","event":"N-able incident 202613 update 03:50:42 UTC: identified additional indicators of compromise and is working with those specific customers. Recorded as IoCs at specific customers, not a vendor ITW mark for 4EverAble2Shell. SecurityWeek 13 Nov quotes the same sentence.","source":{"title":"N-able incident 202613","url":"https://uptime.n-able.com/event/202613/","publisher":"N-able"},"kind":"vendor","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-13","event":"SecurityWeek quotes Lupovis: 21 miners on compromised N-central servers (US 9, South Africa 4, Canada 4, plus UK, Germany, France, Sweden); decoys never execute payloads. Quotes WatchTowr seeing probes for 4EverAble2Shell on Legacy-API-enabled builds. Rechecked CISA KEV catalog 2026.11.10 (1,779 entries) at 18:55 SGT: still not listed.","source":{"title":"Hackers Exploit New N-central Zero-Day Hours After PoC Publication","url":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","publisher":"SecurityWeek"},"kind":"reported","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-13T09:42:00Z","event":"CSIRT Italia published alert AL02/261113/CSIRT-ITA (10:42 Italian time): active exploitation of CVE-2026-90436 in Apache Axis detected on the network, and a public PoC is available. That CVE's catalog page stays Reported exploited. Apache has published no exploitation statement. The alert names no victims, sectors, IOCs, or first-seen date.","source":{"title":"Apache Axis: rilevato sfruttamento in rete della CVE-2026-90436 (AL02/261113/CSIRT-ITA)","url":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436","publisher":"CSIRT Italia"},"kind":"reported","key":true,"addedDate":"2026-11-14"},{"date":"2026-11-14","event":"Rechecked CISA KEV catalog 2026.11.13 (released 2026-11-13T20:24:18.3008Z, 1,781 entries) on 14 Nov 2026: still none of CVE-2026-125883 / 125878 / 125879 / 125880 / 125881 / 125882 / 91000 / 90436. N-able still has no statement naming CVE-2026-90436.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-14"}],"openNotes":[{"title":"Rapid7 ETR still shows no CVE and no build","detail":"Rapid7 Emergency Threat Response (last updated 10 Nov 2026, Updates: Initial publication) still says N-able's notice does not yet include CVE identifiers or CVSS scores, and does not yet identify a remediation build. That is stale against N-able's 2026.4 HF2 notes (Last Updated 10 Nov 2026) and the PUBLISHED CNA records. This page uses the vendor notes and CNA records for the build and CVEs.","sources":[{"url":"https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown/","date":"2026-11-10","publisher":"Rapid7"},{"url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","date":"2026-11-10","publisher":"N-able"}]},{"title":"CNA version string 26.4.1 versus vendor build 2026.4.1.26","detail":"N-able CNA records for six of the seven CVEs say affected before 26.4.1 (defaultStatus unaffected). CVE-2026-91000 says before 2026.4.1. The HF2 notes name build 2026.4.1.26. This page uses 2026.4.1.26 as the fixed version and records the CNA strings as the CNA's own version text, not a second product.","sources":[{"url":"https://cveawg.mitre.org/api/cve/CVE-2026-125883","date":"2026-11-10","publisher":"N-able CNA"},{"url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","date":"2026-11-10","publisher":"N-able"}]},{"title":"N-able has not said how many of the 33 findings the seven CVEs cover","detail":"CSO Online (10 Nov 2026): N-able has not confirmed how many of the 33 flaws it could reproduce, but the new hotfix lists 7 CVEs. BleepingComputer (11 Nov 2026): HF2 has patches for some of the leaked zero-days, including the most critical. BleepingComputer's earlier article described more than 30 alleged zero-days. N-able uptime event 202584: a follow-up hotfix will be released to provide further security updates. Do not treat the seven IDs as a count of the researcher's 33 findings.","sources":[{"url":"https://www.csoonline.com/article/4247028/n-able-n-central-gets-emergency-fix-two-days-after-33-exploits-published.html","date":"2026-11-10","publisher":"CSO Online"},{"url":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/","date":"2026-11-11","publisher":"BleepingComputer"},{"url":"https://uptime.n-able.com/event/202584/","date":"2026-11-11","publisher":"N-able"}]},{"title":"CVE-2026-125878 description and titles differ","detail":"The N-able CNA record description is cross-site scripting / resource injection (CWE-79, CVSS 4.0 8.7). The CNA title, HF2 notes, and BleepingComputer list the same ID as Multiple OGNL Injection vulnerabilities. This page records both wordings and does not pick one as a correction of the other.","sources":[{"url":"https://cveawg.mitre.org/api/cve/CVE-2026-125878","date":"2026-11-10","publisher":"N-able CNA"},{"url":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/","date":"2026-11-11","publisher":"BleepingComputer"}]},{"title":"NVD HTML timed out; FIRST EPSS has no rows","detail":"NVD HTML for CVE-2026-125883 timed out when fetched 11 Nov 2026. An NVD listing showed Received, NVD Published Date 10 Nov 2026, no NVD-produced Primary. FIRST EPSS API total 0 for the seven CVEs (checked 11 Nov 2026). Vendor advisories linked from the CNA records are on me.n-able.com and require login.","sources":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125883","date":"2026-11-11","publisher":"NVD"},{"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-125883","date":"2026-11-11","publisher":"FIRST"}]},{"title":"N-able said HF2 closed unauthenticated issues; later research disputes that","detail":"N-able's 11 Nov 2026 HF2 follow-up said all identified issues that an unauthenticated user could exploit had been addressed, with more hotfixes still to come. Huntress on 12 Nov 2026 reports 4EverAble2Shell and Agent2Shell as unauthenticated chains the researcher states still work against HF2. Evening 12 Nov: N-able incident 202609 is investigating those claims and says, on initial review, the server issue depends on Legacy API being on and internet-exposed. That is a vendor precondition, not a fix. Agent2Shell is still without a vendor statement. This page records both the 11 Nov wording and the later research, plus the 12 Nov precondition, and does not pick a winner.","sources":[{"url":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response","date":"2026-11-11","publisher":"N-able"},{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"},{"url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","publisher":"N-able"}]},{"title":"No CVE IDs for 4EverAble2Shell or Agent2Shell","detail":"Huntress 12 Nov 2026, N-able 11 Nov 2026, and incident 202609 do not assign CVE identifiers for these chains. THN names CVE-2026-90436 as a separate Apache Axis flaw used in an attempted chain, not as an Able2Shell ID. The seven HF2 CVEs remain the IDs for builds older than 2026.4.1.26. This page does not invent CVE IDs.","sources":[{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"},{"url":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response","date":"2026-11-11","publisher":"N-able"},{"url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","publisher":"N-able"},{"url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","date":"2026-11-12","publisher":"The Hacker News"}]},{"title":"N-able named the server issue, not 4EverAble2Shell","detail":"Incident 202609 talks about the server issue described and Legacy API. It does not use the names 4EverAble2Shell or Agent2Shell. The Hacker News maps that server issue to 4EverAble2Shell. This page follows that mapping for the version table and still records no vendor statement yet on Agent2Shell.","sources":[{"url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","publisher":"N-able"},{"url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","date":"2026-11-12","publisher":"The Hacker News"}]},{"title":"THN 12 Nov does not corroborate huntback's successful-exploitation report","detail":"The Hacker News (Ravie Lakshmanan, 12 Nov 2026), quoting Ryan Dewhurst, still says there is no evidence of successful exploitation as of writing. huntback (12 Nov 2026) is a separate third-party report of successful 4EverAble2Shell use on live N-central. This page treats huntback as the Reported exploited source and does not cite THN as corroboration of success. N-able has not confirmed. huntback names Apache Axis as the first step of the mining chain but does not print CVE-2026-90436; that CVE ID was sourced to THN's Previdian attempt chain. CSIRT Italia AL02/261113 (13 Nov 2026) now also names CVE-2026-90436 for active Axis exploitation; Apache has published no exploitation statement. See the Apache Axis catalog page.","sources":[{"url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","date":"2026-11-12","publisher":"The Hacker News"},{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"huntback"}]}],"defenderActions":[{"title":"Disable Legacy API on on-prem N-central now","detail":"N-able incident 202609 (12 Nov 2026): if Legacy API is enabled, disable it now. If you believe it is already off, confirm that. N-able says Legacy API is off by default and is not recommended. N-able links a login article for the how-to. This is vendor guidance for the server issue. It is not a patch, and it does not clearly cover Agent2Shell.","priority":"now","links":[{"label":"N-able incident 202609","href":"https://uptime.n-able.com/event/202609/"},{"label":"How to disable Legacy API (login)","href":"https://me.n-able.com/s/article/How-to-Disable-Legacy-API-settings-on-On-premise-N-central-servers"}]},{"title":"Hosted: N-able turned off Intune as a precaution; keep Legacy API off","detail":"N-able incident 202613 (12 Nov 2026): Intune integration has been turned off on hosted environments while additional protections are implemented and validated. On-prem: if you were running Intune, N-able says it has temporarily deactivated it. Legacy API stays off by default. This is a precaution, not a patch for 4EverAble2Shell or Agent2Shell.","priority":"now","links":[{"label":"N-able incident 202613","href":"https://uptime.n-able.com/event/202613/"}]},{"title":"If Legacy API was on and internet-exposed since 12 Nov, treat the server as potentially compromised","detail":"huntback (12 Nov 2026): weaponised 4EverAble2Shell from 09:16 UTC, and by 12:50 UTC 21 live N-central servers were mining as nc_ rigs, 19 on HF2. If Legacy API was enabled and reachable from the internet since 12 Nov 2026, hunt the artefacts in Detection before assuming the host is clean. Keep Legacy API disabled. N-able has not confirmed. This is not a patch.","priority":"now","links":[{"label":"huntback 4EverAble2Shell miners on live servers","href":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers"},{"label":"N-able incident 202609","href":"https://uptime.n-able.com/event/202609/"},{"label":"Apache Axis CVE-2026-90436 catalog page","href":"/vulns/apache-axis-cve-2026-90436"}]},{"title":"For Agent2Shell, take on-prem N-central offline until there is a fix","detail":"Huntress UPDATE 12 Nov 2026 1:10 AM ET: take the server offline again, or remove all internet access, even if 2026.4 HF2 is installed. Keep it offline until there is a fix for Agent2Shell. N-able's Legacy API statement does not clearly cover Agent2Shell. Do not rely on IP allowlisting alone: Agents and Probes check in on the same affected endpoints.","priority":"now","links":[{"label":"Huntress Able2Shell tracker","href":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains"},{"label":"N-able HF2 follow-up","href":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response"},{"label":"N-able incident 202609","href":"https://uptime.n-able.com/event/202609/"}]},{"title":"Hosted N-central: vendor says not affected by this server issue","detail":"N-able incident 202609: hosted environments are not affected by this issue (the server issue tied to Legacy API). Huntress 12 Nov had said hosted runs the same 2026.4.1.26 build; watch the incident page for further guidance. That hosted mark does not clearly cover Agent2Shell.","priority":"now","links":[{"label":"N-able incident 202609","href":"https://uptime.n-able.com/event/202609/"},{"label":"Huntress Able2Shell tracker","href":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains"}]},{"title":"Upgrade on-prem N-central to 2026.4 HF2 build 2026.4.1.26","detail":"HF2 notes: on-premises customers should upgrade as soon as possible. That build addresses the seven HF2 CVEs. Huntress 12 Nov 2026: HF2 is not a complete fix for 4EverAble2Shell or Agent2Shell; keep the server offline even after HF2 until N-able issues guidance. Supported paths: 2025.4 through 2026.4 HF1; earlier versions upgrade to a supported build first. Use the vendor package.","priority":"now","links":[{"label":"N-central 2026.4 HF2 release notes","href":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/"},{"label":"Huntress Able2Shell tracker","href":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains"}]},{"title":"Upgrade Agents first, then Probes, in hosted and on-prem estates","detail":"HF2 notes: N-able upgrades hosted servers; customers still must upgrade Agents and Probes in both hosted and on-premises environments. Upgrade Agents first, then Probes. A Probe on 2026.4.1.26 cannot talk to an Agent or PME that is not also on 2026.4.1.26.","priority":"now","links":[{"label":"N-central 2026.4 HF2 release notes","href":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/"}]},{"title":"Hunt N-central logs and managed endpoints from 11 Nov 2026","detail":"Huntress 12 Nov 2026: review activity from 11 Nov onward for unexpected administrator accounts, scripts, scheduled tasks, and remote sessions on the server, and unexpected PowerShell or cmd.exe activity launched by the N-able Agent or Probe plus unexpected Windows Software Probe service restarts on endpoints. Keep the earlier 8 Nov lookback for the original Able2Shell drop. A hit is a lead, not proof.","priority":"now","links":[{"label":"Huntress Able2Shell tracker","href":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains"}]}],"detection":[{"title":"huntback 12 Nov 2026: XMRig campaign on live N-central after 4EverAble2Shell","detail":"huntback Research (12 Nov 2026): first public third-party report of successful 4EverAble2Shell use on production N-central, including 2026.4 HF2 build 2026.4.1.26. Weaponised from 09:16 UTC 12 Nov (17:16 SGT); by 12:50 UTC (20:50 SGT) 21 nc_ rigs, all live N-central, 19 on HF2; XMRig as root. Payload host 157.20.241[.]16, pool endpoints, wallet, hashes, host artefacts, persistence, process flags, and the python-requests/2.31.0 user-agent are folded under Compromise checks, each with a log source. N-able has not confirmed. A match is a lead, not vendor-confirmed compromise. Detection only; no exploit steps.","logSource":"Web / reverse-proxy logs, host EDR/filesystem, and egress/firewall logs","kind":"generic","group":"web-proxy","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","described":true},{"title":"Payload host 157.20.241[.]16:8080 and TCP callbacks 19202-19418","detail":"huntback 12 Nov 2026: exploitation source, payload host on TCP 8080, and callback listener on TCP 19202-19418. Defanged. A match is a lead, not vendor-confirmed compromise. Detection only.","logSource":"Egress / firewall logs (outbound TCP 8080 and 19202-19418)","kind":"generic","group":"waf-ips","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"Payload paths jup.sh, /xvgz, /xmrig.tgz, /ob/cronhit, /ob/fcheck","detail":"huntback 12 Nov 2026, defanged: hxxp://157.20.241[.]16:8080/jup.sh (miner installer), /xvgz (gzip miner), /xmrig.tgz (XMRig 6.26.0 tarball fallback), /ob/cronhit and /ob/fcheck (installer check-in beacons). A fetch of those paths is a lead. Detection only.","logSource":"Egress / firewall and web-proxy logs (HTTP to 157.20.241[.]16:8080)","kind":"generic","group":"waf-ips","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"Mining pool 139.99.69[.]109:10128, fallback 79.76.51[.]56:39100","detail":"huntback 12 Nov 2026: primary XMRig pool 139.99.69[.]109:10128, fallback 79.76.51[.]56:39100. Defanged. Outbound sessions to those endpoints are a lead. Detection only.","logSource":"Egress / firewall logs (outbound TCP 10128 and 39100)","kind":"generic","group":"waf-ips","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"Monero wallet used by the nc_ miners","detail":"huntback 12 Nov 2026 wallet 41wx2Pv3FzfRvX11jQgzM4bRbgvr6GViRXCKkHhXhLVQ64mgUR5ks4CEzHx8zqUJ8MgsWwTaWiS3uiZbCgJQnNXoB19mGtr. Presence in miner config or pool stats for an nc_ rig is a lead. Detection only.","logSource":"Host EDR / filesystem (miner config) and pool telemetry if you query it","kind":"generic","group":"edr","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"SHA-256 of the root-escalation script","detail":"huntback 12 Nov 2026: SHA-256 fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747 of the nable-to-root Python script. A hash hit is a lead. Detection only. This page does not describe how that script works.","logSource":"Host EDR / filesystem (file hash)","kind":"generic","group":"edr","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"Host artefacts /tmp/.xvd or /var/tmp/.xvd (x, keep.sh, xm.log)","detail":"huntback 12 Nov 2026: working directory /tmp/.xvd, or /var/tmp/.xvd if /tmp is unusable, with files x, keep.sh, and xm.log. Presence is a lead. Detection only. Do not plant test files.","logSource":"Host EDR / filesystem (/tmp/.xvd and /var/tmp/.xvd)","kind":"generic","group":"edr","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"serverchild-*.bak, .sh, or .out in /var/opt/n-central/tmp/","detail":"huntback 12 Nov 2026: leftover serverchild-*.bak, serverchild-*.sh, or serverchild-*.out under /var/opt/n-central/tmp/. A leftover file is a lead. Detection only. Do not plant test files.","logSource":"Host EDR / filesystem (/var/opt/n-central/tmp/)","kind":"generic","group":"edr","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"Symlink at /var/opt/n-central/flag/flag_default.json","detail":"huntback 12 Nov 2026: a symlink at /var/opt/n-central/flag/flag_default.json. Presence is a lead. Detection only. Do not create a test symlink.","logSource":"Host EDR / filesystem (/var/opt/n-central/flag/)","kind":"generic","group":"edr","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"Persistence xvd.service, /etc/cron.d/xvd, or crontab # xvkeep","detail":"huntback 12 Nov 2026: /etc/systemd/system/xvd.service, /etc/cron.d/xvd, or a crontab line ending # xvkeep for nable or root. Presence is a lead. Detection only.","logSource":"Host EDR / filesystem (systemd units, /etc/cron.d, crontab)","kind":"generic","group":"edr","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"Processes with --rig-id nc_ or --donate-level 1","detail":"huntback 12 Nov 2026: processes whose command line has --rig-id nc_ or --donate-level 1, or a binary named x running from .xvd. A match is a lead. Detection only.","logSource":"Host EDR process telemetry","kind":"generic","group":"edr","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"User-agent python-requests/2.31.0 on ServerUI POSTs","detail":"huntback 12 Nov 2026: weaponised requests used user-agent python-requests/2.31.0 (the earlier checks used Mozilla/5.0). A matching POST is a lead. Detection only. Do not send crafted requests.","logSource":"Web / reverse-proxy logs (User-Agent on POST /dms/services/ServerUI)","kind":"generic","group":"web-proxy","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"SOAP POSTs to /dms/services/ServerUI with exceptionName jline.internal.TerminalLineSettings","detail":"huntback 12 Nov 2026: look in web or reverse-proxy logs for POSTs to /dms/services/ServerUI that return a SOAP fault whose exceptionName is jline.internal.TerminalLineSettings. A matching log line is a lead. Detection only. Do not send crafted SOAP.","logSource":"Web / reverse-proxy logs (POST /dms/services/ServerUI SOAP faults)","kind":"generic","group":"web-proxy","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"Legacy API enabled on an internet-exposed on-prem server","detail":"N-able 12 Nov 2026 initial review: the server issue depends on Legacy API being on and exposed to the public internet. Record whether Legacy API is enabled. A yes is a precondition lead, not proof of compromise. Use the vendor how-to (login). Do not send crafted API requests.","logSource":"N-central on-prem Legacy API setting (product UI)","kind":"generic","group":"web-proxy","url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","described":true},{"title":"Third-party 4EverAble2Shell exploitation attempts on 12 Nov 2026","detail":"Previdian VULN-2026-0009: two attempts, one attacker IP, first seen 12 Nov 2026, none shown as successful on the public page. THN quoting Dewhurst reports the same picture and names Apache Axis CVE-2026-90436 as the attempted first step. watchTowr via THN: probes against Legacy-API-enabled builds. The public Previdian page does not list the IP. huntback later published 157.20.241[.]16 in Detection, sourced to huntback. A matching attempt in your logs is a lead, not proof.","logSource":"N-central server web logs and outbound connection telemetry","kind":"generic","group":"web-proxy","url":"https://previdian.com/VULN-2026-0009","date":"2026-11-12","described":true},{"title":"Anonymous agent-messaging and remote-execution-task requests","detail":"Huntress 12 Nov 2026: from static review of published code, none observed in the wild. Look in server web logs for anonymous agent-messaging and remote-execution-task requests to the dms ServerUI and dms2 ServerMMS2 services. A match is a lead, not proof. Huntress has the full list. Do not send crafted requests.","logSource":"N-central server web logs (dms ServerUI and dms2 ServerMMS2)","kind":"generic","group":"web-proxy","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","described":true},{"title":"Unexpected symlinks, serverchild temp files, or scheduled-task ZIPs","detail":"Huntress 12 Nov 2026, static review only, none observed in the wild: unexpected symlinks or serverchild-* temp files under /var/opt/n-central, and unexpected ZIPs in the scheduled-task output folder. A hit is a lead, not proof. See the Huntress post for the full list. Do not plant test files.","logSource":"N-central server filesystem (/var/opt/n-central and scheduled-task output folder)","kind":"generic","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"SYSTEM PowerShell EncodedCommand spawned by the N-able Agent","detail":"Huntress 12 Nov 2026, static review only, none observed in the wild: SYSTEM PowerShell -EncodedCommand spawned by the N-able Agent. Huntress notes PowerShell as a child of N-able is common; the command being run is what matters. A hit is a lead, not proof. See the Huntress post for the full list.","logSource":"Windows endpoint process telemetry (N-able Agent child processes)","kind":"generic","group":"edr","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","described":true},{"title":"wsp.exe or service.cfg replaced in Windows Software Probe bin folder","detail":"Huntress 12 Nov 2026, static review only, none observed in the wild: wsp.exe or service.cfg replaced in the Windows Software Probe bin folder. Huntress notes the Windows Software Probe process tree alone is expected. A hit is a lead, not proof. See the Huntress post for the full list.","logSource":"Windows file integrity on Windows Software Probe bin folder","kind":"generic","group":"edr","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","described":true},{"title":"Unexplained Windows Software Probe service restarts","detail":"Huntress 12 Nov 2026, static review only, none observed in the wild: unexplained Windows Software Probe service restarts. A restart is a lead, not proof. See the Huntress post for the full list.","logSource":"Windows service events (Windows Software Probe)","kind":"generic","group":"edr","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","described":true},{"title":"New admin accounts, scripts, scheduled tasks, and remote sessions from 11 Nov 2026","detail":"Huntress 12 Nov 2026: from 11 Nov onward, look on the server for unexpected administrator accounts, scripts, scheduled tasks, and remote sessions, and on Windows endpoints for unexpected PowerShell or cmd.exe launched by the N-able Agent or Probe. A hit is a lead, not proof. Keep the 8 Nov lookback for the original drop.","logSource":"N-central audit logs and Windows endpoint telemetry","kind":"generic","group":"web-proxy","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","described":true},{"title":"N-central login and authentication from 8 Nov 2026","detail":"Huntress: review login and authentication activity from 8 Nov onward for unexpected or unauthorized access. A new login is a lead, not proof of Able2Shell. Do not send crafted requests.","logSource":"N-central login and authentication logs","kind":"generic","group":"web-proxy","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-09","described":true},{"title":"New administrator accounts, including Default Administrator","detail":"Huntress: monitor the unauthorized creation of new administrator accounts. The researcher README says the unauthenticated XXE chain can create an enabled Default Administrator. Presence is a lead, not proof. Do not create test accounts.","logSource":"N-central audit logs and administrator inventory","kind":"generic","group":"web-proxy","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-09","described":true},{"title":"Unexpected remote access sessions","detail":"Huntress: monitor for anomalous remote access sessions. A session is a lead, not proof of this disclosure.","logSource":"N-central audit logs for remote sessions","kind":"generic","group":"web-proxy","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-09","described":true},{"title":"New scripts pushed to managed endpoints","detail":"Huntress: during previous N-central exploitations such as CVE-2026-86218, threat actors were observed spraying downstream environments with unauthorized scripts and tools. Monitor for new scripts being deployed. A new script is a lead, not proof of Able2Shell.","logSource":"EDR and script inventory on endpoints managed through N-central","kind":"generic","group":"edr","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-09","described":true},{"title":"No public Nuclei, Sigma, or vendor signature","detail":"None public as of 11 Nov 2026. GitHub code search for Able2Shell Nuclei or Sigma returned no usable hits (rate-limited on an earlier check). Do not invent a rule from the disclosure. Use the log-source pointers above.","logSource":"Public rule indexes (Nuclei, Sigma) and vendor signature bulletins","kind":"generic","date":"2026-11-11","dateKind":"checked"}],"detectionRules":[],"detectionLinks":[],"retrohunt":{"summary":"If an N-central server was reachable from 8 Nov 2026, hunt N-central login and audit logs for new administrator accounts, unexpected remote sessions, and new scripts on managed endpoints. From 12 Nov 2026, also hunt huntback's XMRig campaign artefacts (folded under Detection): payload host 157.20.241[.]16, SOAP POSTs to /dms/services/ServerUI, host paths under /tmp/.xvd and /var/opt/n-central, persistence xvd.service or # xvkeep, and processes with --rig-id nc_. Huntress 12 Nov pointers for Agent2Shell remain. N-able has not confirmed the mining report.","lookback":{"from":"2026-11-08","basis":"public-poc","rationale":"Huntress originally tells defenders to review login and authentication activity from 8 Nov 2026 onward. Huntress UPDATE 12 Nov 2026: review activity from 11 Nov onward for the new chains. SecurityWeek dates the first GitHub publish to Sunday 8 Nov 2026. This lookback keeps 8 Nov as the lower bound so both drops are in range.","sources":[{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-09","publisher":"Huntress"},{"url":"https://www.securityweek.com/n-able-takes-n-central-offline-as-researcher-drops-over-30-zero-days/","date":"2026-11-10","publisher":"SecurityWeek"},{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"},{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"huntback"}]},"logSources":[{"name":"N-central login and authentication logs","why":"Huntress: review login and authentication activity from 8 Nov onward.","required":true},{"name":"N-central audit logs (administrator inventory and remote sessions)","why":"Huntress: new administrator accounts and anomalous remote access sessions.","required":true},{"name":"EDR and script inventory on endpoints managed through N-central","why":"Huntress: new scripts being deployed to downstream environments.","required":false},{"name":"N-central server web logs (dms ServerUI and dms2 ServerMMS2)","why":"Huntress 12 Nov 2026: anonymous agent-messaging and remote-execution-task requests.","required":false},{"name":"N-central server filesystem (/var/opt/n-central and scheduled-task output)","why":"Huntress 12 Nov 2026: unexpected symlinks or serverchild-* temp files, unexpected ZIPs.","required":false},{"name":"Windows endpoint process, file, and service telemetry","why":"Huntress 12 Nov 2026: SYSTEM PowerShell -EncodedCommand from the N-able Agent; wsp.exe or service.cfg in the Probe bin folder; unexplained Windows Software Probe service restarts.","required":false},{"name":"Web / reverse-proxy logs (POST /dms/services/ServerUI)","why":"huntback 12 Nov 2026: SOAP faults with exceptionName jline.internal.TerminalLineSettings, user-agent python-requests/2.31.0.","required":false},{"name":"Egress / firewall logs","why":"huntback 12 Nov 2026: outbound to 157.20.241[.]16 (8080 and 19202-19418) and mining pools 139.99.69[.]109:10128 / 79.76.51[.]56:39100.","required":false},{"name":"Host EDR / filesystem on the N-central server","why":"huntback 12 Nov 2026: /tmp/.xvd, serverchild-* leftovers, flag_default.json symlink, xvd.service, crontab # xvkeep, --rig-id nc_.","required":false}],"steps":[{"title":"Review N-central logins from 8 Nov 2026","detail":"Huntress: review login and authentication activity from 8 Nov onward for unexpected or unauthorized access. A login is not proof of Able2Shell. Do not send crafted requests.","sources":[{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-09","publisher":"Huntress"}]},{"title":"List new administrator accounts, including Default Administrator","detail":"Huntress: unauthorized creation of new administrator accounts. Researcher README: the unauthenticated XXE chain can create an enabled Default Administrator. Presence is a lead, not proof.","sources":[{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-09","publisher":"Huntress"},{"url":"https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able","date":"2026-11-08","publisher":"Sean Bales"}]},{"title":"Review unexpected remote sessions and new endpoint scripts","detail":"Huntress: anomalous remote access sessions, and new scripts being deployed. Huntress notes that during CVE-2026-86218, actors sprayed downstream environments with unauthorized scripts. A hit is a lead for this disclosure, not proof.","sources":[{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-09","publisher":"Huntress"}]},{"title":"Hunt from 11 Nov 2026 for the new chains","detail":"Huntress 12 Nov 2026: on the server, look for unexpected administrator accounts, scripts, scheduled tasks, and remote sessions. On Windows endpoints, look for unexpected PowerShell or cmd.exe activity launched by the N-able Agent or Probe, and unexpected restarts of the Windows Software Probe service. Huntress extracted those pointers from static code review and says none have been observed in the wild. A hit is a lead, not proof.","sources":[{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"}]},{"title":"Hunt huntback XMRig artefacts from 12 Nov 2026","detail":"If Legacy API was enabled and internet-exposed since 12 Nov, hunt the folded Detection list: payload host and callbacks, miner paths, pools, wallet, SHA-256, /tmp/.xvd, serverchild leftovers, flag symlink, xvd persistence, --rig-id nc_, and SOAP exceptionName. A hit is a lead, not vendor-confirmed compromise. Detection only.","sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"huntback"}]}],"queries":[],"artefacts":[{"kind":"account","value":"New or unexpected N-central administrator, including Default Administrator","detail":"Huntress hunting pointer plus researcher README description of an enabled Default Administrator from the unauthenticated XXE chain. Presence is a lead, not proof.","sourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","sourceDate":"2026-11-09"},{"kind":"device-log","value":"Unexpected remote access session on N-central from 8 Nov 2026","detail":"Huntress: monitor for anomalous remote access sessions. A session is a lead, not proof.","sourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","sourceDate":"2026-11-09"},{"kind":"file","value":"New script pushed to a managed endpoint from 8 Nov 2026","detail":"Huntress: new scripts being deployed. Prior N-central incidents involved unauthorized scripts on downstream environments. A new script is a lead, not proof of Able2Shell.","sourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","sourceDate":"2026-11-09"},{"kind":"web-log","value":"Anonymous agent-messaging or remote-execution-task request to dms ServerUI or dms2 ServerMMS2","detail":"Huntress 12 Nov 2026 static review pointer. None observed in the wild. A match is a lead, not proof. See the Huntress post for the full list.","sourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","sourceDate":"2026-11-12"},{"kind":"file","value":"Unexpected symlink or serverchild-* temp file under /var/opt/n-central, or unexpected ZIP in the scheduled-task output folder","detail":"Huntress 12 Nov 2026 static review pointer. None observed in the wild. A hit is a lead, not proof.","sourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","sourceDate":"2026-11-12"},{"kind":"process","value":"SYSTEM PowerShell -EncodedCommand spawned by the N-able Agent","detail":"Huntress 12 Nov 2026 static review pointer. Huntress notes PowerShell as a child of N-able is common; the command being run is what matters. None observed in the wild.","sourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","sourceDate":"2026-11-12"},{"kind":"file","value":"wsp.exe or service.cfg replaced in the Windows Software Probe bin folder","detail":"Huntress 12 Nov 2026 static review pointer. None observed in the wild. A hit is a lead, not proof.","sourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","sourceDate":"2026-11-12"},{"kind":"device-log","value":"Unexplained Windows Software Probe service restart","detail":"Huntress 12 Nov 2026 static review pointer. None observed in the wild. A restart is a lead, not proof.","sourceUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","sourceDate":"2026-11-12"},{"kind":"network","value":"157.20.241[.]16 TCP 8080 and 19202-19418","detail":"huntback 12 Nov 2026 payload host and callbacks. Defanged. A match is a lead.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"kind":"file","value":"/tmp/.xvd or /var/tmp/.xvd (x, keep.sh, xm.log)","detail":"huntback 12 Nov 2026 miner working directory. A hit is a lead.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"kind":"file","value":"/etc/systemd/system/xvd.service, /etc/cron.d/xvd, or crontab # xvkeep","detail":"huntback 12 Nov 2026 persistence. A hit is a lead.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"kind":"process","value":"--rig-id nc_ or --donate-level 1","detail":"huntback 12 Nov 2026 miner process flags. A match is a lead.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"kind":"file","value":"SHA-256 fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747","detail":"huntback 12 Nov 2026 hash of the root-escalation script. A hash hit is a lead. No exploit steps here.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"}],"iocs":[{"type":"ip","value":"157.20.241[.]16","context":"huntback 12 Nov 2026: exploitation source, payload host :8080, callbacks TCP 19202-19418.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"url","value":"hxxp://157.20.241[.]16:8080/jup.sh","context":"huntback 12 Nov 2026 miner installer fetched by the root command.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"url","value":"hxxp://157.20.241[.]16:8080/xvgz","context":"huntback 12 Nov 2026 gzip miner binary.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"url","value":"hxxp://157.20.241[.]16:8080/xmrig.tgz","context":"huntback 12 Nov 2026 XMRig 6.26.0 tarball fallback.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"url","value":"hxxp://157.20.241[.]16:8080/ob/cronhit","context":"huntback 12 Nov 2026 installer check-in beacon.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"url","value":"hxxp://157.20.241[.]16:8080/ob/fcheck","context":"huntback 12 Nov 2026 installer check-in beacon.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"ip","value":"139.99.69[.]109","context":"huntback 12 Nov 2026 primary mining pool :10128.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"ip","value":"79.76.51[.]56","context":"huntback 12 Nov 2026 fallback mining endpoint :39100.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"hash","value":"fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747","context":"huntback 12 Nov 2026 SHA-256 of the nable-to-root Python script.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"path","value":"/tmp/.xvd","context":"huntback 12 Nov 2026 miner working directory (x, keep.sh, xm.log).","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"path","value":"/var/tmp/.xvd","context":"huntback 12 Nov 2026 fallback miner working directory.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"path","value":"/etc/systemd/system/xvd.service","context":"huntback 12 Nov 2026 systemd persistence.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"path","value":"/etc/cron.d/xvd","context":"huntback 12 Nov 2026 cron persistence.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"path","value":"/var/opt/n-central/flag/flag_default.json","context":"huntback 12 Nov 2026 leftover symlink artefact.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"user-agent","value":"python-requests/2.31.0","context":"huntback 12 Nov 2026 user-agent of the weaponised requests.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"filename","value":"jup.sh","context":"huntback 12 Nov 2026 miner installer filename.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"}],"iocNote":"huntback 12 Nov 2026 published the IOCs in Detection, defanged, each with a log source. The public Previdian VULN-2026-0009 page still does not list the attacker IP; 157.20.241[.]16 is sourced to huntback, not copied from Previdian. THN quoted that IP on 12 Nov as an attempts report. N-able has not published attacker IPs. Huntress 12 Nov filesystem and process pointers for Agent2Shell remain from static code review. Do not invent IPs or hashes.","hitMeaning":[{"level":"attempt","detail":"Unexpected N-central login or remote session from 8 Nov 2026, with no new administrator account and no new script on managed endpoints."},{"level":"likely-compromise","detail":"huntback host artefacts on an internet-exposed N-central: /tmp/.xvd or /var/tmp/.xvd, xvd.service or crontab # xvkeep, processes with --rig-id nc_, or outbound connections to 157.20.241[.]16. Third-party IOCs dated 12 Nov 2026. A hit is a lead, not vendor-confirmed compromise."},{"level":"likely-compromise","detail":"A new administrator account (including unexpected Default Administrator) or new scripts pushed to managed endpoints on an N-central server that was reachable from 8 Nov 2026, before 2026.4 HF2 build 2026.4.1.26."},{"level":"compromise","detail":"Evidence that attacker-controlled code ran as nable or root on the N-central server, or that N-central was used to run unauthorized commands on managed endpoints. huntback 12 Nov 2026 reports XMRig running as root on live N-central after 4EverAble2Shell; third-party research, not vendor-confirmed. Huntress UPDATE 10 Nov 2026: N-able said it had no evidence of successful customer exploitation at that time. Independent validation: not verified.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"If Legacy API was on and exposed since 12 Nov, hunt huntback artefacts","detail":"Keep Legacy API disabled. If it was enabled and internet-exposed since 12 Nov 2026, treat the server as potentially compromised and hunt the folded Detection list. For Agent2Shell, Huntress take-offline advice still stands.","links":[{"label":"huntback 4EverAble2Shell miners on live servers","href":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers"},{"label":"N-able incident 202609","href":"https://uptime.n-able.com/event/202609/"},{"label":"Huntress Able2Shell tracker","href":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains"}]},{"title":"Disable Legacy API; for Agent2Shell keep on-prem offline","detail":"N-able 12 Nov: disable Legacy API now if it is enabled. Huntress: for Agent2Shell, take the server offline or remove all internet access until a fix. Do not rely on IP allowlisting alone. Hosted: vendor says not affected by this server issue; watch incident 202609.","links":[{"label":"Huntress Able2Shell tracker","href":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains"},{"label":"N-able HF2 follow-up","href":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response"},{"label":"N-able incident 202609","href":"https://uptime.n-able.com/event/202609/"}]},{"title":"Preserve N-central logs and endpoint telemetry before upgrade","detail":"Keep copies of N-central login, audit, and remote-session logs, plus endpoint script inventory, from 8 Nov 2026 onward before upgrade.","links":[{"label":"Huntress Able2Shell tracker","href":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains"}]}],"limits":["huntback 12 Nov 2026 is third-party research, not a vendor confirmation.","The Hacker News 12 Nov still said no evidence of successful exploitation and is not used as corroboration of huntback's mining report.","N-able has not confirmed 4EverAble2Shell in-the-wild use. N-able 12 Nov: Legacy API off by default; keep it disabled; no fix yet.","Huntress UPDATE 12 Nov 2026: Agent2Shell indicators came from static code review; none observed in the wild at that writing.","A matching IOC, symlink, or SOAP fault is a lead, not proof by itself.","huntback does not print CVE-2026-90436; THN named it on the Previdian attempt chain, and CSIRT Italia AL02/261113 (13 Nov 2026) now also names it for Axis exploitation.","No public Nuclei, Sigma, or IDS rule was found as of 11 Nov 2026.","Huntress UPDATE 12 Nov 2026: new-chain indicators came from static code review; none observed in the wild.","Huntress UPDATE 10 Nov 2026: N-able said it had no evidence of successful customer exploitation; Huntress has not observed partner-environment exploitation.","N-able 11 Nov 2026: no indications of compromise within hosted N-central servers.","A new admin account, remote session, symlink, or Probe restart is not proof of Able2Shell.","First calendar day of successful compromise: not verified.","No public Nuclei, Sigma, or IDS rule was found as of 11 Nov 2026."],"sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"huntback"},{"url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","publisher":"N-able"},{"url":"https://previdian.com/VULN-2026-0009","date":"2026-11-12","publisher":"Previdian"},{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"},{"url":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response","date":"2026-11-11","publisher":"N-able"},{"url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","date":"2026-11-10","publisher":"N-able"},{"url":"https://www.csoonline.com/article/4247028/n-able-n-central-gets-emergency-fix-two-days-after-33-exploits-published.html","date":"2026-11-10","publisher":"CSO Online"}],"updatedAt":"2026-11-13"},"amIAffected":{"summary":"Compare installed N-central to vendor build 2026.4.1.26 for the seven HF2 CVEs. For 4EverAble2Shell, huntback and Lupovis (via SecurityWeek) report successful use on live servers; N-able 13 Nov reports IoCs at specific customers, not a vendor ITW mark. N-able 12 Nov: the server issue needs Legacy API on and internet-exposed; no fix yet. If Legacy API was on and exposed since 12 Nov, treat the server as potentially compromised. Agent2Shell: no vendor statement yet. Hosted: N-able says not affected by this server issue; Intune is off as a precaution.","checks":[{"id":"v2s-aia-able2shell-n-able-n-central-version-1","kind":"version","title":"Record the installed N-central appliance version","detail":"Compare the appliance version from the product UI or inventory to 2026.4.1.26. This is inventory only. Do not send crafted requests.","command":"Record the N-central appliance version shown in the product UI or appliance inventory, and compare it to 2026.4.1.26.","affectedMeans":"The recorded server version is before 2026.4.1.26 (CNA: before 26.4.1; CVE-2026-91000: before 2026.4.1). Researcher-tested 2026.4.0.31 is in that range.","fixedMeans":"The recorded server version is 2026.4.1.26 (N-central 2026.4 HF2) or later for the seven HF2 CVEs, or the estate no longer runs N-central. That build is not a complete fix for 4EverAble2Shell or Agent2Shell. N-able 12 Nov: no fix yet for the server issue; disable Legacy API.","notes":"HF2 notes name build 2026.4.1.26 as the fix for the seven published CVEs. Huntress 12 Nov says treat even a fully patched server as vulnerable to the new chains. N-able incident 202609 adds a Legacy API precondition for the server issue and still publishes no fix build.","sources":[{"url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","date":"2026-11-10","publisher":"N-able"},{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"},{"url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","publisher":"N-able"}]},{"id":"v2s-aia-able2shell-n-able-n-central-config-2","kind":"config","title":"Record hosting model, Legacy API, whether on-prem is still online, and Agent/Probe versions","detail":"N-able 12 Nov: on-prem should disable Legacy API if it is on. Huntress: for Agent2Shell, on-prem should stay offline until a fix. Hosted: vendor says not affected by this server issue. Record Agent and Probe versions. Do not send application requests.","command":"Record whether each N-central instance is N-able hosted or on-premises, whether Legacy API is enabled, whether an on-prem server is currently reachable, and the Agent and Probe versions. Do not send application requests.","affectedMeans":"An on-prem server has Legacy API enabled, or is still reachable from the internet pending an Agent2Shell fix, or Agents or Probes (hosted or on-prem) are still before 2026.4.1.26.","fixedMeans":"On-prem Legacy API is confirmed off, on-prem remains unreachable from the internet pending an Agent2Shell fix, hosted operators are watching incident 202609, and Agents and Probes are 2026.4.1.26 or later for the HF2 communication change.","notes":"Ecoverse remaining available under N-able Login is not an N-central restore. Upgrade Agents first, then Probes.","sources":[{"url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","publisher":"N-able"},{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"},{"url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","date":"2026-11-10","publisher":"N-able"}]}],"limits":["N-able 12 Nov: no fix yet for the server issue; Legacy API off is a precondition, not a patch. Agent2Shell still has no vendor statement. Huntress 12 Nov: treat HF2 as still vulnerable to both chains.","CSO Online (10 Nov 2026) citing Censys: 1,728 internet-exposed N-central instances. BleepingComputer (11 Nov 2026) citing Shadowserver: 1,338 on Monday 9 Nov, just over 148 on 11 Nov. No fingerprint, port, or query was published. Do not invent a banner.","CVE-keyed scanners can query CVE-2026-125883 and the six HF2 siblings; FIRST EPSS had no rows as of 11 Nov 2026. No CVE IDs were assigned for the new chains in the Huntress 12 Nov or N-able 11 Nov sources.","CNA version strings are 26.4.1 / 2026.4.1; the vendor build is 2026.4.1.26.","Do not send crafted N-central requests."],"sources":[{"url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","publisher":"N-able"},{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"},{"url":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response","date":"2026-11-11","publisher":"N-able"},{"url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","date":"2026-11-10","publisher":"N-able"},{"url":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/","date":"2026-11-11","publisher":"BleepingComputer"}],"updatedAt":"2026-11-13","addedDate":"2026-11-11"},"mitigations":{"summary":"Keep Legacy API disabled (N-able 12 Nov; off by default). N-able 202613 also turned off Intune on hosted servers and says it is developing additional remediation. If Legacy API was enabled and internet-exposed since 12 Nov, treat the server as potentially compromised and hunt huntback artefacts. For Agent2Shell, Huntress still says take on-prem offline until a fix. HF2 is still not a complete fix for 4EverAble2Shell or Agent2Shell.","items":[{"title":"Disable Legacy API on on-prem N-central","detail":"N-able incident 202609: if Legacy API is enabled, disable it now. If you think it is already off, confirm that. N-able says it is off by default and is not recommended.","limits":"Vendor precondition for the server issue, not a patch. Does not clearly cover Agent2Shell. The how-to article requires login.","verify":"On-prem Legacy API setting is disabled. Confirm in the product UI. Do not send application requests as a test.","source":{"url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","publisher":"N-able"}},{"title":"Leave Intune integration off until N-able restores it","detail":"N-able incident 202613: Intune integration has been turned off on hosted environments as a precaution. On-prem customers running it were told N-able temporarily deactivated it, or support would contact them. Tenable's 12 Nov FAQ records the same hosted and on-prem Intune step.","limits":"Precaution while additional remediation is developed. Not a patch.","verify":"Confirm Intune integration is off in the product UI. Do not send application requests as a test.","source":{"url":"https://uptime.n-able.com/event/202613/","date":"2026-11-12","publisher":"N-able"}},{"title":"If Legacy API was on and exposed since 12 Nov, hunt before assuming the host is clean","detail":"huntback 12 Nov 2026 reports XMRig as root on live N-central after 4EverAble2Shell, including HF2. If Legacy API was enabled and reachable from the internet since 12 Nov, hunt the Detection artefacts.","limits":"Third-party report, not a vendor confirmation. Not a patch.","verify":"Legacy API is disabled, and the huntback host, process, and egress checks in Detection have been run. Do not send application requests as a test.","source":{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"huntback"}},{"title":"For Agent2Shell, take on-prem N-central offline even after HF2","detail":"Huntress UPDATE 12 Nov 2026 1:10 AM ET: take the server offline again, or remove all internet access, even if you have applied 2026.4 HF2. Keep it offline until there is a fix for Agent2Shell. N-able's Legacy API statement does not clearly cover Agent2Shell.","limits":"This is Huntress guidance, not a vendor hotfix. It does not patch Agent2Shell.","verify":"On-prem N-central no longer answers on the internet. Confirm at the edge or host. Do not send application requests as a test.","source":{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"}},{"title":"Do not treat IP allowlisting as enough","detail":"Huntress 12 Nov 2026: do not rely on IP allowlisting alone. The affected endpoints are the same ones Agents and Probes use to check in, so any device on an allowed network can still reach them.","limits":"Allowlisting can still shrink exposure. It is not a substitute for taking the server off the internet pending vendor guidance.","verify":"On-prem N-central is unreachable from the internet, not only restricted to an allowlist that still includes Agent and Probe networks.","source":{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"}},{"title":"Upgrade on-prem N-central to 2026.4.1.26 for the seven HF2 CVEs, while staying offline","detail":"HF2 notes: on-premises customers should upgrade as soon as possible. That build addresses the seven published HF2 CVEs. Huntress 12 Nov: it is not a complete fix for the new chains; stay offline until N-able issues guidance. Supported paths are 2025.4 through 2026.4 HF1; earlier versions upgrade to a supported build first.","limits":"Not a substitute for hunting from 8 Nov 2026, or from 11 Nov for the new chains. Hosted servers were upgraded by N-able for HF2 and run the same build.","verify":"On-prem N-central reports 2026.4.1.26 and no longer answers on the network. Confirm at the edge or host. Do not send application requests as a test.","source":{"url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","date":"2026-11-10","publisher":"N-able"}},{"title":"Upgrade Agents first, then Probes","detail":"HF2 notes: the hotfix changes Agent-to-Probe communication. Upgrade Agents first, then Probes, in hosted and on-premises environments. A Probe on 2026.4.1.26 cannot talk to an Agent or PME that is not also on 2026.4.1.26.","limits":"PME is pushed automatically; HF2 notes say no action is required for PME.","verify":"Agent, Probe, and (if used) PME inventory shows 2026.4.1.26 or later. Re-check after the next change window.","source":{"url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","date":"2026-11-10","publisher":"N-able"}},{"title":"Do not treat Ecoverse as an N-central restore","detail":"The Hacker News quotes N-able: Ecoverse services under N-able Login remain available and online, including Asset View, Patching, Vulnerability Management, scripting, policies and tagging. Hosted N-central classic was restored by N-able applying HF2, not by Ecoverse remaining up.","limits":"This is scope, not a workaround. It does not patch N-central.","verify":"Operators are using Ecoverse only as N-able describes, and on-prem N-central is not brought back before 2026.4.1.26.","source":{"url":"https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html","date":"2026-11-10","publisher":"The Hacker News"}}],"updatedAt":"2026-11-13","addedDate":"2026-11-11"},"response":{"summary":"Keep Legacy API disabled. N-able 13 Nov reports IoCs at specific customers; hunt huntback artefacts if Legacy API was on and exposed since 12 Nov. For Agent2Shell, take the server offline until a fix (Huntress). Hosted: vendor says not affected by this server issue; Intune is off; watch incidents 202609 and 202613.","containment":[{"title":"Disable Legacy API on on-prem N-central","detail":"N-able incident 202609: if Legacy API is enabled, disable it now, and confirm it is off otherwise.","sources":[{"url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","publisher":"N-able"}]},{"title":"If Legacy API was on and exposed since 12 Nov, treat the server as potentially compromised","detail":"huntback 12 Nov 2026: 21 live N-central miners, 19 on HF2. Hunt the folded Detection list. Keep Legacy API disabled. N-able has not confirmed.","sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"huntback"},{"url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","publisher":"N-able"}]},{"title":"For Agent2Shell, take on-prem offline until a fix","detail":"Huntress UPDATE 12 Nov 2026: take the server offline again or remove all internet access, even if 2026.4 HF2 is installed. N-able's Legacy API statement does not clearly cover Agent2Shell. Do not rely on IP allowlisting alone.","sources":[{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"},{"url":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response","date":"2026-11-11","publisher":"N-able"},{"url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","publisher":"N-able"}]},{"title":"Upgrade Agents first, then Probes","detail":"Required for hosted and on-premises. HF2 notes: a Probe on 2026.4.1.26 cannot talk to an Agent or PME that is not also on 2026.4.1.26.","sources":[{"url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","date":"2026-11-10","publisher":"N-able"}]},{"title":"Review N-central logs and managed endpoints from 8 Nov and from 11 Nov 2026","detail":"Huntress 12 Nov 2026: new admin accounts, scripts, scheduled tasks, remote sessions, plus Windows Agent/Probe process, file, and service pointers from static review (none observed in the wild). Rapid7: review N-central servers and downstream managed systems for signs of compromise.","sources":[{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"}]}],"rotate":[{"item":"Privileged N-central credentials and related MSP admin / service accounts","reason":"Rescana (10 Nov 2026): after restore under vendor guidance, rotate privileged N-central credentials and review related MSP admin and service accounts. N-able has not published a rotation list. This is third-party guidance, not a vendor IOC or persistence list.","sources":[{"url":"https://www.rescana.com/post/n-able-n-central-able2shell-zero-days-prepare-now","date":"2026-11-10","publisher":"Rescana"}]}],"evidence":[{"title":"Installed N-central version from before restore","detail":"Keep the appliance version so you can show whether the install was before 2026.4.1.26, including researcher-tested 2026.4.0.31.","sources":[{"url":"https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown/","date":"2026-11-10","publisher":"Rapid7"}]},{"title":"N-central login and audit logs from 8 Nov 2026","detail":"Keep login, administrator-creation, and remote-session records from the Huntress lookback day onward.","sources":[{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-09","publisher":"Huntress"}]},{"title":"Endpoint script and remote-access telemetry for managed systems","detail":"Keep EDR or script-inventory records for endpoints managed through N-central. No sourced persistence path was published for Able2Shell.","generic":true,"sources":[{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-09","publisher":"Huntress"}]},{"title":"huntback XMRig host and egress artefacts from 12 Nov 2026","detail":"Keep copies of web/reverse-proxy logs for POST /dms/services/ServerUI, host paths under /tmp/.xvd and /var/opt/n-central, systemd/cron persistence, and egress to 157.20.241[.]16 and the named pools.","sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"huntback"}]}],"limits":["Huntress UPDATE 12 Nov 2026: new-chain indicators came from static code review; none observed in the wild.","Huntress UPDATE 10 Nov 2026: N-able said it had no evidence of successful customer exploitation; Huntress has not observed partner-environment exploitation.","huntback 12 Nov 2026 published XMRig persistence paths and IOCs, third-party, not vendor-confirmed.","No public Nuclei or Sigma rule was found as of 11 Nov 2026.","HF2 build 2026.4.1.26 addresses the seven published CVEs and is not a complete fix for 4EverAble2Shell or Agent2Shell. N-able 12 Nov publishes no fix for the server issue.","Public Previdian VULN-2026-0009 does not list attacker IPs. huntback 12 Nov 2026 published 157.20.241[.]16 in Detection, sourced to huntback."],"sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"huntback"},{"url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","publisher":"N-able"},{"url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-12","publisher":"Huntress"},{"url":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response","date":"2026-11-11","publisher":"N-able"},{"url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","date":"2026-11-10","publisher":"N-able"}],"updatedAt":"2026-11-13","addedDate":"2026-11-11"},"bulletins":[],"coverage":[{"title":"Apache Axis: rilevato sfruttamento in rete della CVE-2026-90436 (AL02/261113/CSIRT-ITA)","publisher":"CSIRT Italia","url":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436","date":"2026-11-13","type":"government","addedDate":"2026-11-14"},{"title":"Able2Shell FAQ, N-able N-central zero-days and Hotfix 2","publisher":"Tenable","url":"https://www.tenable.com/blog/able2shell-frequently-asked-questions-for-reported-n-able-n-central-zero-day-vulnerabilities","date":"2026-11-12","type":"news","addedDate":"2026-11-13"},{"title":"New N-able 4EverAble2Shell zero-day exploited hours after PoC released","publisher":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/","date":"2026-11-12","type":"news","addedDate":"2026-11-13"},{"title":"N-central Critical Security Update (incident 202613)","publisher":"N-able","url":"https://uptime.n-able.com/event/202613/","date":"2026-11-12","type":"vendor","addedDate":"2026-11-13"},{"title":"Hackers Exploit New N-central Zero-Day Hours After PoC Publication","publisher":"SecurityWeek","url":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","date":"2026-11-13","type":"news","addedDate":"2026-11-13"},{"title":"4EverAble2Shell is already mining Monero on live N-central servers","publisher":"huntback","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","type":"research","addedDate":"2026-11-13"},{"title":"N-central Critical Security Incident - 2026.4.1 HF2 Release","publisher":"N-able","url":"https://uptime.n-able.com/event/202609/","date":"2026-11-12","type":"vendor","addedDate":"2026-11-12"},{"title":"New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access","publisher":"The Hacker News","url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","date":"2026-11-12","type":"news","addedDate":"2026-11-12"},{"title":"VULN-2026-0009 Exploitation Attempts Observed, N-central","publisher":"Previdian","url":"https://previdian.com/VULN-2026-0009","date":"2026-11-12","type":"research","addedDate":"2026-11-12"},{"title":"N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains","publisher":"Huntress","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","date":"2026-11-09","type":"research","addedDate":"2026-11-11"},{"title":"Critical vulnerabilities in N-able N-central prompt hosted shutdown","publisher":"Rapid7","url":"https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown/","date":"2026-11-10","type":"research","addedDate":"2026-11-11"},{"title":"N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days","publisher":"SecurityWeek","url":"https://www.securityweek.com/n-able-takes-n-central-offline-as-researcher-drops-over-30-zero-days/","date":"2026-11-10","type":"news","addedDate":"2026-11-11"},{"title":"N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits","publisher":"The Hacker News","url":"https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html","date":"2026-11-10","type":"news","addedDate":"2026-11-11"},{"title":"N-able N-central Able2Shell: Public Disclosure of Critical Vulnerabilities","publisher":"Rescana","url":"https://www.rescana.com/post/n-able-n-central-able2shell-zero-days-prepare-now","date":"2026-11-10","type":"news","addedDate":"2026-11-11"},{"title":"N-able incident 202561","publisher":"N-able","url":"https://uptime.n-able.com/event/202561/","date":"2026-11-09","type":"vendor","addedDate":"2026-11-11"},{"title":"CISA KEV catalog JSON (Able2Shell CVEs not listed; catalog 2026.11.13)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-13","type":"government","addedDate":"2026-11-14"},{"title":"N-central 2026.4 HF2 Release Notes","publisher":"N-able","url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","date":"2026-11-10","type":"vendor","addedDate":"2026-11-11"},{"title":"CVE-2026-125883 (N-able CNA)","publisher":"N-able CNA","url":"https://cveawg.mitre.org/api/cve/CVE-2026-125883","date":"2026-11-10","type":"vendor","addedDate":"2026-11-11"},{"title":"N-able N-central gets emergency fix two days after 33 exploits published","publisher":"CSO Online","url":"https://www.csoonline.com/article/4247028/n-able-n-central-gets-emergency-fix-two-days-after-33-exploits-published.html","date":"2026-11-10","type":"news","addedDate":"2026-11-11"},{"title":"N-able incident 202584","publisher":"N-able","url":"https://uptime.n-able.com/event/202584/","date":"2026-11-11","type":"vendor","addedDate":"2026-11-11"},{"title":"N-able releases security hotfixes for zero-day vulnerabilities","publisher":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/","date":"2026-11-11","type":"news","addedDate":"2026-11-11"},{"title":"Update on N-central 2026.4 HF2 and ongoing security response","publisher":"N-able","url":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response","date":"2026-11-11","type":"vendor","addedDate":"2026-11-12"}],"posts":[{"author_name":"Defused","handle":"DefusedCyber","url":"https://x.com/DefusedCyber/status/2120177846970691916","date":"2026-11-10T15:32:44Z","text":"🚨 During the past 24 hours, we have observed probing of N-able N-central for the 0-days that were dropped publicly yesterday.\n\nWe have seen opening of anonymous agent sessions, pulling appliance config and hitting the remote control endpoint without auth. These pathways are part of the 0-day exploit surface.\n\nIf you run N-central exposed, take it off the internet now.\n\nTrack exploit intelligence 👉 http://console.defusedcyber.com/intel"}],"research":[{"title":"Able2Shell public README (N-Central N-Able folder)","url":"https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able","authors":"Sean Bales","date":"2026-11-08"},{"title":"N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains","url":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","authors":"Lindsey O'Donnell-Welch, Susannah Matt","date":"2026-11-09"},{"title":"Critical vulnerabilities in N-able N-central prompt hosted shutdown","url":"https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown/","authors":"Rapid7","date":"2026-11-10"},{"title":"N-central 2026.4 HF2 Release Notes","url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","authors":"N-able","date":"2026-11-10"},{"title":"N-able releases security hotfixes for zero-day vulnerabilities","url":"https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/","authors":"Sergiu Gatlan","date":"2026-11-11"},{"title":"Update on N-central 2026.4 HF2 and ongoing security response","url":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response","authors":"N-able","date":"2026-11-11"},{"title":"N-central Critical Security Incident - 2026.4.1 HF2 Release","url":"https://uptime.n-able.com/event/202609/","authors":"N-able","date":"2026-11-12"},{"title":"New N-central Exploits Work Against Patched Servers","url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","authors":"Ravie Lakshmanan","date":"2026-11-12"},{"title":"VULN-2026-0009 N-central Remote Code Execution","url":"https://previdian.com/VULN-2026-0009","authors":"Previdian","date":"2026-11-12"},{"title":"4EverAble2Shell is already mining Monero on live N-central servers","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","authors":"huntback","date":"2026-11-12"},{"title":"N-central Critical Security Update (incident 202613)","url":"https://uptime.n-able.com/event/202613/","authors":"N-able","date":"2026-11-12"},{"title":"Hackers Exploit New N-central Zero-Day Hours After PoC Publication","url":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","authors":"Ionut Arghire","date":"2026-11-13"},{"title":"New N-able 4EverAble2Shell zero-day exploited hours after PoC released","url":"https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/","authors":"Lawrence Abrams","date":"2026-11-12"},{"title":"Able2Shell FAQ, N-able N-central zero-days and Hotfix 2","url":"https://www.tenable.com/blog/able2shell-frequently-asked-questions-for-reported-n-able-n-central-zero-day-vulnerabilities","authors":"Tenable Research Special Operations","date":"2026-11-12"}],"impact":{"kind":"single-product","product":"N-able N-central","versions":[{"version":"N-central on-premises before 2026.4.1.26 (CNA: before 26.4.1; CVE-2026-91000: before 2026.4.1). Researcher-tested Appliance 2026.4.0.31 is in this range. This row is the seven HF2 CVEs only.","status":"affected","versions":"2026.4.1.26","vendorStatement":{"date":"2026-11-10","url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","quote":"To keep your environment protected, customers running on-premises N-central deployments should upgrade their servers as soon as possible."},"addedDate":"2026-11-11"},{"version":"N-central on-premises 2026.4 HF2 build 2026.4.1.26, 4EverAble2Shell (server issue). N-able 12 Nov initial review: depends on Legacy API enabled and exposed. N-able 202613: no fix yet; restricting features including Legacy API and Intune; developing additional remediation. Huntress 12 Nov (static review) and the researcher still state the chain works against this build.","status":"under-investigation","versions":"none","vendorStatement":{"date":"2026-11-12","url":"https://uptime.n-able.com/event/202609/","quote":"Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet. Legacy API is turned off by default in the product and is not recommended."},"addedDate":"2026-11-12"},{"version":"N-central on-premises 2026.4 HF2 build 2026.4.1.26, Agent2Shell. Huntress 12 Nov (static review) and THN: unauthenticated commands on managed Windows endpoints, including as SYSTEM. Incident 202609 does not name Agent2Shell.","status":"no-statement-yet","versions":"none","addedDate":"2026-11-12"},{"version":"Hosted N-central server (NCOD), server issue / 4EverAble2Shell. N-able 12 Nov: hosted environments are not affected by this issue. Huntress 12 Nov had noted hosted runs the same 2026.4.1.26 build.","status":"vendor-stated-not-affected","versions":"Hosted not affected by this issue (vendor, 12 Nov 2026)","vendorStatement":{"date":"2026-11-12","url":"https://uptime.n-able.com/event/202609/","quote":"Hosted environments are not affected by this issue."},"addedDate":"2026-11-12"},{"version":"Hosted N-central server (NCOD), Agent2Shell. Incident 202609 hosted-not-affected wording is for this issue (the server / Legacy API issue). No vendor statement yet on Agent2Shell.","status":"no-statement-yet","versions":"none","addedDate":"2026-11-12"},{"version":"N-central Agents and Probes (hosted and on-premises). HF2 still requires Agents then Probes on 2026.4.1.26. Huntress and THN: Agent2Shell is in server-to-Windows Agent and Probe communication; no vendor statement yet on a further Agent or Probe fix for those chains.","status":"affected","versions":"2026.4.1.26","vendorStatement":{"date":"2026-11-10","url":"https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/","quote":"All customers, both hosted and on-premises, must upgrade their Agents and Probes."},"addedDate":"2026-11-11"}]},"pocs":[{"title":"Able2Shell public folder on Oracle-Security/CVEs (for defenders)","url":"https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able","source":"Sean Bales","validationStatus":"unverified","validationDate":null,"listedDate":"2026-11-08","alsoUrl":"https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains","notes":"Public GitHub folder README titled Able2Shell - N-Central N-Able. SecurityWeek (10 Nov 2026) says Sean Bales published on GitHub on Sunday (8 Nov 2026). Commit 77e8fb6 is timestamped 2026-11-09T04:14:21Z. Huntress UPDATE 12 Nov 2026 1:10 AM ET: the researcher later published two more sets of exploit code (4EverAble2Shell and Agent2Shell). Status unverified (static review only), 12 Nov 2026, source Huntress. Huntress's look at that code was static; Huntress says none of those indicators have been observed in the wild. That is a researcher claim plus a Huntress static review, not a vuln2shell validation. Index link only. This site does not copy exploit code, payloads, or usage steps.","addedDate":"2026-11-11"}],"pocEmptyState":"Public researcher folder is indexed as Unverified (static review only, 12 Nov 2026, source Huntress). This site does not copy exploit code.","_feed":{"page":"https://vuln2shell.com/vulns/able2shell-n-able-n-central","json":"https://vuln2shell.com/vulns/able2shell-n-able-n-central.json","iocsCsv":"https://vuln2shell.com/vulns/able2shell-n-able-n-central/iocs.csv","stix":"https://vuln2shell.com/vulns/able2shell-n-able-n-central/stix.json","badges":{"patch":"Partly patched","itw":"Reported exploited","poc":"Public PoC (unverified RCE)"}}}