Skip to navigation

Threat reportVulnerabilityTL-2026-5859

N-central 4EverAble2Shell and Agent2Shell exploits (root RCE and Windows SYSTEM) work against build 2026.4.1.26; exploitation attempts chained with CVE-2026-90436

criticalACTIVE

Public PoC exploits from researcher Sean Bales reportedly work against N-able N-central On-premise 2026.4 HF2 (build 2026.4.1.26): 4EverAble2Shell gives unauthenticated root RCE on the server when the non-default Legacy API is enabled and internet-exposed, and Agent2Shell chains more than 10 zero-days to run commands as NT AUTHORITY\SYSTEM on managed Windows agents.

Key facts

IdentifiersTL-2026-5859, CVE-2026-90436
Also known as4EverAble2Shell, Agent2Shell, Able2Shell
SeverityCRITICAL
CVSS9.8
First disclosed
Affected productsN-able N-central On-premise; N-able N-central managed Windows Agent; Apache Software Foundation Apache Axis 1.x (end-of-life)
Weaknesses (CWE)CWE-470, CWE-59
Tools4EverAble2Shell, Able2Shell, Agent2Shell
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1041 Exfiltration Over C2 Channel, T1048 Exfiltration Over Alternative Protocol, T1053.003 Cron, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.004 Unix Shell, T1059.006 Command and Scripting Interpreter, T1068 Exploitation for Privilege Escalation, T1070.004 File Deletion, T1071.001 Web Protocols, T1095 Non-Application Layer Protocol and 12 more in the attack flow
MotivationFINANCIAL
Target sectorstechnology, managed-service-providers
Target regionsNorth America, Europe, Asia-Pacific
Detection rules9 (1 shown free)
Sources13 cited sources

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5859 across Splunk SPL, Microsoft KQL and Sigma, covering 49 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: N-central Server Java Process Spawning Shell or curl — Post-Exploitation

Detects the N-central Linux server Java process (or its servlet container) spawning sh/bash/curl/wget/nc. This is the expected post-exploitation artifact of the CVE-2026-90436 + 4EverAble2Shell chain, where code execution through the Axis deserialization flaw is followed by root escalation and a curl download of a shell script.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1059.004, T1190
  • Data sources: sysmon_for_linux, auditd, mde_linux
  • Severity: critical
  • Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" (EventID=1 OR EventCode=1) earliest=-24h
  (ParentImage="*/java" OR ParentImage="*/jre/bin/java")
  (Image="*/sh" OR Image="*/bash" OR Image="*/dash" OR Image="*/curl" OR Image="*/wget" OR Image="*/nc" OR Image="*/ncat")
  (ParentCommandLine="*ncentral*" OR ParentCommandLine="*n-central*" OR ParentCommandLine="*N-able*" OR ParentCommandLine="*tomcat*" OR ParentCommandLine="*jboss*")
| eval threat_id="TL-2026-5859", cve="CVE-2026-90436", chain="4EverAble2Shell"
| stats count min(_time) AS first_seen max(_time) AS last_seen values(CommandLine) AS commands by host User ParentImage Image threat_id cve chain
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "java"
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat")
| where InitiatingProcessCommandLine has_any ("ncentral", "n-central", "N-able", "tomcat", "jboss")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend ThreatId = "TL-2026-5859", Chain = "CVE-2026-90436 + 4EverAble2Shell"

Sigma

title: N-central Server Java Process Spawns Shell or Download Utility
id: a2c94e17-5d03-4b68-8f2a-1c7e9b4d6a02
status: experimental
description: Detects a Java process of the N-central server spawning a shell, curl, wget or netcat, matching the post-exploitation behaviour of the CVE-2026-90436 and 4EverAble2Shell chain.
references:
  - https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html
  - https://previdian.com/VULN-2026-0009
  - https://openwall.com/lists/oss-security/2026/11/06/12
  - https://nvd.nist.gov/vuln/detail/cve-2026-90436
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial-access
  - attack.t1190
  - cve.2026.90436
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/java'
    ParentCommandLine|contains:
      - 'ncentral'
      - 'n-central'
      - 'N-able'
      - 'tomcat'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - N-central maintenance scripts launched by the application during upgrades or backups
  - Administrators using documented diagnostic shells via the N-central Java service
level: high

Known false positives:

  • N-central upgrade, backup or health-check scripts that fork shells from the Java service
  • Administrator troubleshooting sessions

Tuning notes: Baseline child processes of the N-central Java service for 14 days and allowlist known script command lines (upgrade, backup). Keep curl/wget/nc alerts unsuppressed. Scope to N-central server hosts via a host lookup.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • N-central Unauthenticated Agent-Session / Remote-Control Endpoint Probing from External IP — Exploitation · unlock with TL Creds
  • curl/wget Download-and-Execute of Shell Script from [indicator] — Post-Exploitation · unlock with TL Creds
  • N-central Windows Agent Spawning Interpreter as SYSTEM — Agent2Shell Lateral Execution · unlock with TL Creds
  • Burst of HTTP 500 Responses to SOAP Service POSTs on N-central Server — Exploit Attempt Indicator · unlock with TL Creds
  • syslog-ng Configuration Modified by Non-Package Process on N-central Server — Root Privilege Escalation · unlock with TL Creds
  • Download Utility or Cradle Launched by N-central Windows Agent — Agent2Shell Tool Transfer · unlock with TL Creds
  • N-central CVE-2026-90436 Axis 1.x SOAP Fault Class-Instantiation Attempt — Exploitation · unlock with TL Creds
  • Connection to Reported N-central Exploit Staging Host [indicator] or PoC Repository — C2/Ingress · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 49 indicators of compromise for TL-2026-5859.

Sample indicators (3 of 49)

  • IP address: 157.20.241[.]16
  • URL: hxxps://github[.]com/MSPNightmare/CVEs/tree/main/0-Days/N-Central%20N-Able
  • File hash: fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747

Defanged, TLP:CLEAR. Full set of 49 indicators: unlock with TL Creds.

49 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Probing and attempted exploitation began within hours of PoC release; no successful exploitation has been confirmed and no fix exists for the two new exploits.

On 2026-11-12 The Hacker News reported that new public proof-of-concept exploits by independent researcher Sean Bales, published in the MSPNightmare/CVEs GitHub repository (0-Days/N-Central N-Able, alongside the earlier Able2Shell folder), work against N-central On-premise 2026.4 Hotfix 2 (build 2026.4.1.26), the build N-able shipped on 2026-11-10 to address the Able2Shell disclosure. 4EverAble2Shell is described as unauthenticated remote code execution as root on the N-central server. N-able states the server issue depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet; the Legacy API is off by default and not recommended. Agent2Shell is described as chaining more than 10 zero-day vulnerabilities to run commands on managed Windows agents as NT AUTHORITY\SYSTEM, and requires the attacker to know the target appliance ID. No CVEs have been assigned to either new exploit and the source article states no fix is available. The repository's technical write-ups could not be retrieved, so exploit internals (endpoints, weakness classes) are not documented here.

Previdian (founded by Ryan Dewhurst) and watchTowr reported targeted probing of 4EverAble2Shell within hours of PoC release. Previdian reported the observed chain as: initial code execution through CVE-2026-90436 (unauthenticated remote class instantiation via deserialization of an inbound SOAP Fault in end-of-life Apache Axis 1.x through 1.4, CVSS 9.8, CWE-470, patched/published 2026-11-06), privilege escalation to root with 4EverAble2Shell, then download and execution of a shell script with curl from 157.20.241.16. Previdian's public telemetry page for VULN-2026-0009 showed 4 attempts from a single attacker IP on 2026-11-12 and states the affected range and fixed build are unverified; it warns the public PoC is unverified and may contain malware. The sources do not state the name, hash or contents of the downloaded script, and do not tie CVE-2026-90436 to N-central in the vendor advisories retrieved; the link is Previdian's reported observation.

Context: Able2Shell (30+ vulnerabilities disclosed by Bales on or about 2026-11-08 to 2026-11-10) led N-able to take Hosted N-central offline and urge on-premises customers to shut servers down. Fixes in HF2 include CVE-2026-125883 (XXE), CVE-2026-125878 (OGNL injection), CVE-2026-125879 (LPE to root via writable syslog-ng config), CVE-2026-125880 (stored XSS), CVE-2026-125881 (schema-hint SSRF), CVE-2026-125882 (file upload path traversal RCE) and CVE-2026-91000 (insecure IPC LPE). Censys counts 1,728 internet-exposed N-central instances. Hosted N-central is not affected by the server issue per N-able. N-central is an RMM platform, so compromise of the server or agents gives control of downstream managed endpoints. CISA KEV status for the new flaws is not stated; CVE-2026-90436 is not in KEV per OpenCVE.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 File Deletion; T1222.002 Linux and Mac File and Directory Permissions Modification; T1564.001 Hidden Files and Directories

Exfiltration

T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol

Persistence

T1053.003 Cron; T1543.002 Systemd Service

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.004 Unix Shell; T1059.006 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548.003 Sudo and Sudo Caching

Command and Control

T1071.001 Web Protocols; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Impact

T1496 Resource Hijacking; T1496.001 Compute Hijacking

Resource Development

T1588.005 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

  • N-central 2026.4 HF2 (build 2026.4.1.26) addresses Able2Shell issues only; it does not fix 4EverAble2Shell or Agent2Shell per the source article
  • Upgrade all Agents first, then Probes, on hosted and on-premises (N-able guidance)

Immediate actions

  • Disable the N-central Legacy API immediately if enabled (off by default, not recommended) and remove public internet exposure of the N-central server
  • Apply the CVE-2026-90436 (Apache Axis 1.x) fix: apply the Apache commit 41f3b4e8d04e310ca81f86b92630ab2c11d608bd or migrate off Axis 1.x
  • Block and hunt for 157.20.241.16 in proxy, firewall, DNS and EDR telemetry
  • Review N-central login/authentication activity from 2026-11-08 onward and audit logs for secondary indicators of compromise (Huntress guidance)

Workarounds

  • Turn off the Legacy API
  • Keep on-premises N-central servers offline or not internet-reachable until N-able confirms updates are safe (N-able/Huntress guidance)

Longer-term hardening

  • Restrict N-central server and agent management interfaces to trusted networks or VPN
  • Monitor N-central servers for unexpected outbound curl/wget downloads and child shell processes of the Java application
  • Monitor managed Windows agents for unexpected SYSTEM-context command execution spawned by the N-central agent
  • Track N-able advisories for fixes to 4EverAble2Shell and Agent2Shell

Affected and fixed versions

  • N-able — N-central On-premise
    Vulnerable versions: 2026.4 HF2 (build 2026.4.1.26) with Legacy API enabled and internet-exposed (4EverAble2Shell)
  • N-able — N-central managed Windows Agent
    Vulnerable versions: Agents on 2026.4.1.26 deployments (Agent2Shell; requires known appliance ID)
  • Apache Software Foundation — Apache Axis 1.x (end-of-life)
    Vulnerable versions: through 1.4
    Fixed in: Commit 41f3b4e8d04e310ca81f86b92630ab2c11d608bd (no 1.x release planned)

Timeline

Last updated · 4 updates · revalidated 4× · latest source

Showing the 20 most recent tracked events.

  • CVE-2026-90436 (Apache Axis 1.x SOAP Fault unsafe class instantiation) reserved.
  • CVE-2026-90436 published via oss-security with patch commit; Apache does not plan an Axis 1.x release and recommends migration.
  • Huntress recommends reviewing N-central login and authentication activity from this date onward following the Able2Shell disclosure.
  • Independent researcher publishes write-ups and PoC code for 33 alleged N-central flaws (Able2Shell) to GitHub; Huntress sees four chains (three RCE, one root privilege escalation). N-able takes hosted N-central offline and tells on-premises customers to take servers offline.
  • Scanning tied to the Able2Shell PoC observed; Previdian logs 68 attempts from one IP against one honeypot and Defused Cyber reports unauthenticated agent-session and remote-control endpoint probing.
  • N-able releases N-central 2026.4 HF2 (build 2026.4.1.26) fixing Able2Shell CVEs; Hosted N-central taken offline as a precaution and on-premises customers urged to shut servers down.
  • Per Huntress/Cybersecuritynews, 4EverAble2Shell and Agent2Shell were published late on Nov 11, stated to work against HF2; Huntress's static review supports the unauthenticated root chain.
  • 4EverAble2Shell and Agent2Shell PoCs appear in the public GitHub repository at about 03:58 UTC; the repository is updated at 07:48 UTC to note the Legacy API requirement.
  • N-able restricts features: Legacy API disabled by default in hosted environments and Intune integration turned off; customers urged to upgrade Agents and Probes to 2026.4 HF1 or later. Exact date not stated by sources.
  • BleepingComputer publishes the 4EverAble2Shell exploitation report; N-able says it is developing further fixes.
  • At 12:50 UTC the mining pool shows 21 active nc_ N-central rigs (about 25 kH/s) across the US, Canada, South Africa, UK, Germany, France and Sweden; 19 ran 2026.4.1.26 HF2.
  • Previdian adds VULN-2026-0009 to its KEV catalog at 09:45 UTC with confirmed in-the-wild exploitation.
  • Huntback sees the first weaponized request at 09:16 UTC (root escalation and XMRig install), repeated at 09:36, 10:03 and 10:05 UTC with callback ports 19202-19418.
  • locked-ioc-20 probes Huntback and Previdian N-central honeypots from about 08:30 UTC; Previdian records exploitation at 08:24 UTC.
  • N-able advisory (6:30 AM ET) states the original chain needs Legacy API exposed to the internet and does not advise taking servers offline; no fix for the new issues at publication.
  • Huntress publishes technical update with static-analysis indicators (not observed in the wild) and advises taking on-premises servers offline or removing internet access, noting IP allowlisting alone is insufficient.
  • Previdian and watchTowr observe probing and attempted exploitation within hours; observed chain is CVE-2026-90436, then 4EverAble2Shell, then curl download of a shell script from locked-ioc-20. No successful exploitation confirmed.
  • Sean Bales publishes 4EverAble2Shell and Agent2Shell PoCs reported to work against build 2026.4.1.26; N-able says the server issue requires Legacy API enabled and internet-exposed.
  • N-able says it has identified additional IOCs and is contacting affected customers, alongside restricting Legacy API and Intune integration; SecurityWeek reports the exploitation.
  • The Hacker News reports active exploitation infecting 21 N-central servers (19 on Hotfix 2) with an XMRig Monero miner.

Update history

Sources cited

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated . Reviewed .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats