Zero-Day Exploits Hit N-central Hours After Researcher Drops PoC

A disgruntled security researcher named Sean Bales publicly released exploit code for a new zero-day vulnerability in N-able N-central, dubbed 4EverAble2Shell. The flaw allows unauthenticated attackers to execute remote code with root privileges on servers running the latest patches, even those updated to the 2026.4 HF2 build intended to fix earlier issues. The exploit chains a known Apache Axis vulnerability (CVE-2026-90436) with a hole in N-central's Legacy API.

Threat actors began actively exploiting the vulnerability mere hours after the proof-of-concept was published. N-able has reacted by restricting features like the Legacy API and Intune integration and is working with affected customers. This rapid weaponization highlights the critical danger posed when exploit code is released publicly before vendors can effectively respond, putting countless managed service providers and their clients at immediate risk.

What to do: Restrict Legacy API and Intune integration features on N-central servers.