# N-central 4EverAble2Shell and Agent2Shell exploits (root RCE and Windows SYSTEM) work against build 2026.4.1.26; exploitation attempts chained with CVE-2026-90436

> Public PoC exploits from researcher Sean Bales reportedly work against N-able N-central On-premise 2026.4 HF2 (build 2026.4.1.26): 4EverAble2Shell gives unauthenticated root RCE on the server when the non-default Legacy API is enabled and internet-exposed, and Agent2Shell chains more than 10 zero-days to run commands as NT AUTHORITY\SYSTEM on managed Windows agents. Probing and attempted exploitation began within hours of PoC release; no successful exploitation has been confirmed and no fix exists for the two new exploits.

- **Published:** 2026-11-12T12:56:51Z
- **Last reviewed:** 2026-11-13T08:38:20.437Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5859
- **ID:** TL-2026-5859
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 49 (3 shown free below)
- **CVEs:** CVE-2026-90436

## Description

On 2026-11-12 The Hacker News reported that new public proof-of-concept exploits by independent researcher Sean Bales, published in the MSPNightmare/CVEs GitHub repository (0-Days/N-Central N-Able, alongside the earlier Able2Shell folder), work against N-central On-premise 2026.4 Hotfix 2 (build 2026.4.1.26), the build N-able shipped on 2026-11-10 to address the Able2Shell disclosure. 4EverAble2Shell is described as unauthenticated remote code execution as root on the N-central server. N-able states the server issue depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet; the Legacy API is off by default and not recommended. Agent2Shell is described as chaining more than 10 zero-day vulnerabilities to run commands on managed Windows agents as NT AUTHORITY\SYSTEM, and requires the attacker to know the target appliance ID. No CVEs have been assigned to either new exploit and the source article states no fix is available. The repository's technical write-ups could not be retrieved, so exploit internals (endpoints, weakness classes) are not documented here.

Previdian (founded by Ryan Dewhurst) and watchTowr reported targeted probing of 4EverAble2Shell within hours of PoC release. Previdian reported the observed chain as: initial code execution through CVE-2026-90436 (unauthenticated remote class instantiation via deserialization of an inbound SOAP Fault in end-of-life Apache Axis 1.x through 1.4, CVSS 9.8, CWE-470, patched/published 2026-11-06), privilege escalation to root with 4EverAble2Shell, then download and execution of a shell script with curl from 157.20.241.16. Previdian's public telemetry page for VULN-2026-0009 showed 4 attempts from a single attacker IP on 2026-11-12 and states the affected range and fixed build are unverified; it warns the public PoC is unverified and may contain malware. The sources do not state the name, hash or contents of the downloaded script, and do not tie CVE-2026-90436 to N-central in the vendor advisories retrieved; the link is Previdian's reported observation.

Context: Able2Shell (30+ vulnerabilities disclosed by Bales on or about 2026-11-08 to 2026-11-10) led N-able to take Hosted N-central offline and urge on-premises customers to shut servers down. Fixes in HF2 include CVE-2026-125883 (XXE), CVE-2026-125878 (OGNL injection), CVE-2026-125879 (LPE to root via writable syslog-ng config), CVE-2026-125880 (stored XSS), CVE-2026-125881 (schema-hint SSRF), CVE-2026-125882 (file upload path traversal RCE) and CVE-2026-91000 (insecure IPC LPE). Censys counts 1,728 internet-exposed N-central instances. Hosted N-central is not affected by the server issue per N-able. N-central is an RMM platform, so compromise of the server or agents gives control of downstream managed endpoints. CISA KEV status for the new flaws is not stated; CVE-2026-90436 is not in KEV per OpenCVE.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1068 Exploitation for Privilege Escalation
- T1210 Exploitation of Remote Services
- T1027 Obfuscated Files or Information
- T1222.002 Linux and Mac File and Directory Permissions Modification
- T1070.004 File Deletion
- T1564.001 Hidden Files and Directories
- T1543.002 Systemd Service
- T1053.003 Cron
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1095 Non-Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking
- T1548.003 Sudo and Sudo Caching
- T1571 Non-Standard Port
- T1048 Exfiltration Over Alternative Protocol
- T1496.001 Compute Hijacking
- T1059.006 Command and Scripting Interpreter

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**N-central Server Java Process Spawning Shell or curl — Post-Exploitation** (`TL-2026-5859-SPL-002`)

Detects the N-central Linux server Java process (or its servlet container) spawning sh/bash/curl/wget/nc. This is the expected post-exploitation artifact of the CVE-2026-90436 + 4EverAble2Shell chain, where code execution through the Axis deserialization flaw is followed by root escalation and a curl download of a shell script.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.004, T1190
- **Data sources:** sysmon_for_linux, auditd, mde_linux
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" (EventID=1 OR EventCode=1) earliest=-24h
  (ParentImage="*/java" OR ParentImage="*/jre/bin/java")
  (Image="*/sh" OR Image="*/bash" OR Image="*/dash" OR Image="*/curl" OR Image="*/wget" OR Image="*/nc" OR Image="*/ncat")
  (ParentCommandLine="*ncentral*" OR ParentCommandLine="*n-central*" OR ParentCommandLine="*N-able*" OR ParentCommandLine="*tomcat*" OR ParentCommandLine="*jboss*")
| eval threat_id="TL-2026-5859", cve="CVE-2026-90436", chain="4EverAble2Shell"
| stats count min(_time) AS first_seen max(_time) AS last_seen values(CommandLine) AS commands by host User ParentImage Image threat_id cve chain
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "java"
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat")
| where InitiatingProcessCommandLine has_any ("ncentral", "n-central", "N-able", "tomcat", "jboss")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend ThreatId = "TL-2026-5859", Chain = "CVE-2026-90436 + 4EverAble2Shell"
```

### Sigma

```yaml
title: N-central Server Java Process Spawns Shell or Download Utility
id: a2c94e17-5d03-4b68-8f2a-1c7e9b4d6a02
status: experimental
description: Detects a Java process of the N-central server spawning a shell, curl, wget or netcat, matching the post-exploitation behaviour of the CVE-2026-90436 and 4EverAble2Shell chain.
references:
  - https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html
  - https://previdian.com/VULN-2026-0009
  - https://openwall.com/lists/oss-security/2026/11/06/12
  - https://nvd.nist.gov/vuln/detail/cve-2026-90436
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial-access
  - attack.t1190
  - cve.2026.90436
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/java'
    ParentCommandLine|contains:
      - 'ncentral'
      - 'n-central'
      - 'N-able'
      - 'tomcat'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - N-central maintenance scripts launched by the application during upgrades or backups
  - Administrators using documented diagnostic shells via the N-central Java service
level: high

```

**Known false positives:**

- N-central upgrade, backup or health-check scripts that fork shells from the Java service
- Administrator troubleshooting sessions

**Tuning notes:** Baseline child processes of the N-central Java service for 14 days and allowlist known script command lines (upgrade, backup). Keep curl/wget/nc alerts unsuppressed. Scope to N-central server hosts via a host lookup.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- N-central Unauthenticated Agent-Session / Remote-Control Endpoint Probing from External IP — Exploitation (locked: unlock with TL Creds)
- curl/wget Download-and-Execute of Shell Script from [indicator] — Post-Exploitation (locked: unlock with TL Creds)
- N-central Windows Agent Spawning Interpreter as SYSTEM — Agent2Shell Lateral Execution (locked: unlock with TL Creds)
- Burst of HTTP 500 Responses to SOAP Service POSTs on N-central Server — Exploit Attempt Indicator (locked: unlock with TL Creds)
- syslog-ng Configuration Modified by Non-Package Process on N-central Server — Root Privilege Escalation (locked: unlock with TL Creds)
- Download Utility or Cradle Launched by N-central Windows Agent — Agent2Shell Tool Transfer (locked: unlock with TL Creds)
- N-central CVE-2026-90436 Axis 1.x SOAP Fault Class-Instantiation Attempt — Exploitation (locked: unlock with TL Creds)
- Connection to Reported N-central Exploit Staging Host [indicator] or PoC Repository — C2/Ingress (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 49)

Defanged, TLP:CLEAR.

- IP address: `157.20.241[.]16`
- URL: `hxxps://github[.]com/MSPNightmare/CVEs/tree/main/0-Days/N-Central%20N-Able`
- File hash: `fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747`

Full set of 49 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Hacker News: New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access](https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html)
- [The Hacker News: N-able Takes Hosted N-central Offline (Able2Shell)](https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html)
- [N-able advisory](https://uptime.n-able.com/event/202609/)
- [N-able Able2Shell advisory](https://uptime.n-able.com/event/202584/)
- [N-central 2026.4 HF2 release notes](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/)
- [Sean Bales CVE/PoC repository (4EverAble2Shell, Able2Shell, Agent2Shell)](https://github.com/MSPNightmare/CVEs/tree/main/0-Days/N-Central%20N-Able)
- [Previdian VULN-2026-0009 telemetry](https://previdian.com/VULN-2026-0009#telemetry)
- [Sean Bales post on X](https://x.com/seankbales/status/2120729661017555235)
- [watchTowr post on X (probing observed)](https://x.com/watchtowrcyber/status/2120803577094439123)
- [oss-security: Apache Axis 1.x CVE-2026-90436](https://openwall.com/lists/oss-security/2026/11/06/12)
- [OpenCVE: CVE-2026-90436](https://app.opencve.io/cve/CVE-2026-90436)
- [Apache Axis 1 patch commit for CVE-2026-90436](https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd)
- [NVD: CVE-2026-90436](https://nvd.nist.gov/vuln/detail/cve-2026-90436)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5859