In this article
Developing story, updated as details confirm.
What happened
New public exploits for N-able N-central, nicknamed 4EverAble2Shell, were released on November 12. In its incident notice, N-able tells on-premises customers to make sure the Legacy API is disabled and says it is still “developing additional remediation.” On November 13 at 11:50 a.m. Manila (UTC+8), it said it had “identified additional Indicators of Compromise (IOCs)” and was working with those customers.
Security firm huntback reports miners on 21 N-central servers, 19 of them on Hotfix 2, according to The Hacker News and BleepingComputer. N-able has not confirmed that count. The chain has no CVE of its own and is not in CISA’s Known Exploited Vulnerabilities catalog.
Who’s affected
On-premises N-central servers with the non-default Legacy API turned on. The researcher says that setting is required and that he tested against Hotfix 2 (2026.4.1.26). N-able says hosted customers need no server-side action. Small businesses may be exposed if their MSP’s on-premises N-central server is compromised.
What to do now
- Disable the Legacy API, as N-able advises. It is off by default.
- Patching alone may not be enough. Check for compromise: huntback, as quoted by The Hacker News, says to treat a hit as a full compromise, not a cleanup job.
- Keep Hotfix 2 and upgrade Agents and Probes, Agents first.
See our emergency patch checklist, ScreenConnect MSP attacks, security and news.
Updates
- Nov 13, 2026, 2:36 p.m. Manila (UTC+8): Initial report, from N-able’s incident 202613 notice and its November 13 update, the Hotfix 2 release notes and N-able’s November 11 blog, with exploitation reports attributed to The Hacker News and BleepingComputer.
Sources & method
- N-able, N-central security incident 202613 (opened 2026-11-12T16:00 UTC; update 2026-11-13T03:50 UTC) — https://uptime.n-able.com/event/202613
- N-able, N-central 2026.4 HF2 Release Notes (build 2026.4.1.26, November 10, 2026) — https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/
- N-able, Update on N-central 2026.4 HF2 and ongoing security response (November 11, 2026) — https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response
- The Hacker News, Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2 (November 13, 2026) — https://thehackernews.com/2026/11/hackers-exploit-n-central-flaws-to.html
- BleepingComputer, New N-able “4EverAble2Shell” zero-day exploited hours after PoC released (November 12, 2026) — https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/
- CISA Known Exploited Vulnerabilities catalog (JSON feed) — https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Last checked: Nov 13, 2026, 2:36 p.m. Manila (UTC+8). Method: We read N-able’s incident 202613 record through its official status API, the Hotfix 2 release notes and N-able’s November 11 blog at about 2:20 p.m. Manila (UTC+8), and re-checked incident 202613 and the release notes at 2:36 p.m. The 21-server and 19-on-Hotfix-2 figures are huntback’s, as reported by The Hacker News and BleepingComputer; N-able has not confirmed them. N-able’s notice still says “we have seen no signs of compromise,” while its later update reports IOCs; we quote both. N-able has not published a CVE or CVSS score for 4EverAble2Shell. We do not reproduce exploit code. Thumbnail is a reuse-licensed photograph, cropped and resized, credited with its license under the picture. No affiliate links. How we work.
Spotted an error? See our corrections policy and tell us.
