N-able has imposed new restrictions on N-central after public disclosure of two exploit chains, 4EverAble2Shell and Agent2Shell, that enable remote code execution with root or SYSTEM privileges.
The company stated it is restricting certain features and integrations while remediation continues. In hosted environments the Legacy API is now disabled by default and Intune integration has been turned off. Customers running N-central 2026.4 HF1 and above are advised to upgrade both Agents and Probes because the update changes how the two components communicate.
On-premises customers must also upgrade Agents and Probes and confirm that Legacy API access is disabled. N-able emphasized that applying Hotfix 2 alone is insufficient, noting that 19 of the 21 compromised servers were already running the hotfix.
Independent researcher Sean Bales disclosed the flaws, which affect the most recent version of N-central. The 4EverAble2Shell chain exploits an unsafe class instantiation issue in the bundled Apache Axis component tracked as CVE-2026-90436 (CVSS 9.8) together with a separate privilege-escalation weakness.
Threat intelligence firm Previdian tracks the issue as VULN-2026-0009 and confirmed that a crafted SOAP request can lead to command execution as the nable service account. Huntback observed the same activity delivering the script jup.sh from IP 157.20.241[.]16, which mounts /tmp as executable and installs an XMRig Monero miner configured to use only half the available CPU cores.
The 21 affected servers are located in the United States, South Africa, Canada, the United Kingdom, Germany, France, and Sweden. Huntback warned that root access on an N-central host constitutes a full compromise of managed customer endpoints and should be treated accordingly.
