Attackers began exploiting a newly published N-able N-central chain dubbed 4EverAble2Shell on Thursday, hours after a researcher released proof-of-concept code, BleepingComputer reported, citing firms that said compromised servers were used to run cryptocurrency miners¹.

The same-day attacks follow N-able taking hosted N-central environments offline earlier in the week after independent researcher Sean Bales published more than 30 alleged zero-day issues with exploits^2,3.

Bales released two additional exploits on Nov. 12, 4EverAble2Shell and Agent2Shell, which he said he tested against N-central Appliance 2026.4.1.26 HF2, the emergency update N-able issued Nov. 10¹.

BleepingComputer said 4EverAble2Shell allows unauthenticated command execution as root on vulnerable N-central servers if Legacy API functionality is enabled, combining Apache Axis CVE-2026-90436 with a separate N-central privilege-escalation weakness¹.

Agent2Shell, BleepingComputer said, is claimed to let attackers run commands with SYSTEM privileges on Windows devices via N-central agent functionality¹.

Previdian told BleepingComputer that probing for 4EverAble2Shell started shortly after the public PoC, with attackers first using the Axis bug as the nable service account then escalating to root; the firm tracks the escalation as VULN-2026-0009¹.

Huntback, also cited by BleepingComputer, said at least 21 production N-central servers were compromised with Bales' public chain, including 19 running 2026.4.1.26, the latest Hotfix 2 build¹.

In a Nov. 12 status note, N-able said it was adding protections, including restricting some features and integrations, while it develops further fixes, and that hosted environments already had those measures; it also said it had seen no signs of compromise using the new flaws¹.

The Hacker News, writing Nov. 10, reported N-able's earlier statement that it was taking hosted N-central offline as a precaution while it secured the environment, and that it had not observed active exploitation of those earlier disclosed flaws².

BleepingComputer's Nov. 9 account said Bales posted the Able2Shell repository late Nov. 8, that discovery was AI-assisted, and that N-able described the dump as non-responsible communication of critical vulnerabilities³.

Bales told BleepingComputer he skipped prior notice because, he said, two unrelated remote-code-execution bugs and a privilege-escalation issue in a different N-able product remained unpatched after five to six months³.

N-able's independent verification of every claimed flaw, the full number of compromised customers, and whether Agent2Shell is also in use were not established in the coverage^1,2,3.