N-able investigates N-central flaw claims as attackers hit hotfix 2 servers

On Thursday, N-able said it is examining a newly public disclosure that alleges more weaknesses in on-premise copies of N-central, specifically version 2026.4.1 HF2. From the company's first pass, the server problem in that disclosure shows up only if administrators have enabled the Legacy API—an option that is not the default—and left it reachable from the internet.

BleepingComputer reported that intruders were already abusing a just-published N-central zero-day nicknamed 4EverAble2Shell, and that this began within hours of a proof-of-concept appearing. The attackers broke into servers and installed crypto-mining software. Researchers counted at least 21 compromised systems, 19 of them on Hotfix 2, which that reporting called N-able's newest security release. The same exploits are reported to succeed on machines that had already been patched, opening root remote code execution and Windows SYSTEM privileges.

In its Thursday update, N-able said it is adding further safeguards after a public release of flaws identified as 4EverAble2Shell and Agent2Shell. The vendor is limiting selected N-central capabilities and some integrations. It said those limits might interfere with certain functions and that it is keeping them in place until remediation is finished.