N-able Says Disable N-central Legacy API and Check Servers

On-premises N-able N-central administrators should disable the Legacy API if it is turned on, and check their servers for signs of compromise. N-able’s advisory, opened at 07:00 UTC (07:00 GMT) on 12 November 2026 and quoted in a Huntress update the same day, says the server issue “depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet.” The company says Legacy API “is turned off by default in the product and is not recommended,” and that “Hosted environments are not affected by this issue.”

For on-premises servers, Huntress quotes N-able as saying: “If Legacy API is enabled: Disable Legacy API now.” Huntress, in an update at 06:30 ET (11:30 GMT) on 12 November, also says N-able has published a knowledge base article on how to turn the setting off, and is not telling customers to take N-central offline for this issue. If the Legacy API has to stay on, Huntress says access should be kept off the public internet until N-able issues a fix.

What Huntress and N-able say about 4EverAble2Shell

The advice follows two further exploit names, 4EverAble2Shell and Agent2Shell, published after N-able’s 10 November hotfix for an earlier set of flaws known as Able2Shell. Huntress says 4EverAble2Shell is an unauthenticated remote code execution chain that results in root access on the N-central server. It also says the exploit author later updated the public repository to state that the chain only works with Legacy API turned on, and that servers running N-central 2026.4 HF2 (build 2026.4.1.26) with Legacy API disabled “are not exposed to this exploit chain.”

That is a narrower position than Huntress’s earlier 01:10 ET (06:10 GMT) note on 12 November, which had told on-premises customers to take servers offline again even after HF2. The 06:30 ET update says N-able’s advisory changes that guidance.

Huntress has not yet established whether Agent2Shell, which it describes as more than ten issues in how the N-central server talks to Windows Agents and Probes, also depends on Legacy API. Two of those chains, Huntress says, could let someone who can reach the server run commands on managed Windows endpoints, including as SYSTEM. Huntress says that, as of its 12 November writing, it “has not observed exploitation of these issues in our partners’ environments.”

N-able’s 11 November blog on HF2 dealt with the earlier Able2Shell wave. There the company said it was seeing scanning tied to published proof-of-concept code, but “we have seen no indications of compromise within N-central hosted servers.” That statement is about hosted servers and the earlier disclosure. It is not a finding about whether 4EverAble2Shell has been used against on-premises servers with Legacy API exposed.

huntback’s account of mining on live servers

Separately, huntback says it has seen 4EverAble2Shell used in the wild to install an XMRig Monero miner on live N-central servers. That exploitation finding is huntback’s, not N-able’s. N-able’s advisory, as quoted by Huntress, does not say that servers have been exploited.

According to huntback, the 4EverAble2Shell proof of concept was published at 03:58 UTC (03:58 GMT) on 12 November 2026. The firm says its decoys saw a first probe at 08:30 UTC (08:30 GMT) and a weaponised chain from 09:16 UTC (09:16 GMT). At 12:50 UTC (12:50 GMT), it says a public mining pool listed 21 rigs named with an nc_ prefix, all of which served the N-central login page. Of those 21, huntback says 19 were running build 2026.4.1.26, which is N-central 2026.4 Hotfix 2. It placed them in the United States (9), South Africa (4), Canada (4), and the United Kingdom, Germany, France and Sweden (one each). The same wallet, it says, had 631 rig names overall, including prefixes tied to other widely used software.

huntback tells N-central owners to look for a hidden .xvd directory under temporary folders, a service named xvd.service, and related persistence and process artefacts, and to treat a hit as a full compromise rather than a simple clean-up. The firm’s post, and Huntress’s earlier indicator list, set out the fuller checks. TSN is not reproducing exploit requests or network addresses here.

The same caution that applies to other internet-facing remote-management tools applies here. TSN has recently covered ScreenConnect partners being told to avoid new sessions after SCKit, an exploited Ivanti Connect Secure flaw, and Lumen’s account of Volt Typhoon using zero-days for access. Those are different products and different cases. What they share with this one is the need to follow the vendor’s current fix, and to inspect the server if it was reachable in a risky configuration.

Background: Able2Shell and Hotfix 2

On 9 November, Huntress says, N-able took hosted N-central environments offline after an independent researcher published 33 flaws in the server-side application, grouped as Able2Shell. On 10 November, N-able released N-central 2026.4 HF2, build 2026.4.1.26, and said hosted servers had been upgraded and brought back online. Huntress says all customers, hosted and on-premises, were also told to upgrade Agents and Probes. Those Able2Shell fixes are the context for HF2. They are not a numbered CVE for 4EverAble2Shell, and none has been assigned for that later chain.

Analysis

The first practical step is the one N-able and Huntress now put first: on an on-premises N-central server, check whether Legacy API is on, and turn it off if it is. The issue, in N-able’s wording, needs that non-default setting to be both enabled and exposed to the public internet. A server on HF2 with Legacy API disabled is, on Huntress’s updated account of the author’s own repository note, not exposed to this particular chain. Hosted N-central, N-able says, is not affected.

That is a different statement from “every patched server is safe in every configuration,” and it is also different from “every patched server is vulnerable.” huntback’s 19-of-21 figure is an observation about servers it saw on a mining pool, 19 of which were running the HF2 build. It supports the narrower point that applying Hotfix 2 was not enough on its own for those hosts. It does not, by itself, show how those servers were configured, and it is not a finding published by N-able.

The in-the-wild mining claim should stay attached to huntback. Huntress says it has not seen exploitation in its partners’ environments. N-able’s quoted advisory describes the configuration dependency and the hosted exemption; it does not adopt huntback’s pool counts. Anyone who finds the miner artefacts huntback lists should treat the box, and the endpoints it manages, as compromised.

Agent2Shell remains a separate, unresolved question. Huntress has not yet established whether those chains also need Legacy API. Until that is clearer, administrators should follow N-able’s current Legacy API guidance and keep reading both the vendor advisory and the Huntress updates, rather than rely on the early-morning 12 November advice to take every on-premises server offline.

Sources

• Huntress, 9 November 2026, updated 12 November 2026, 06:30 ET (11:30 GMT). “N-able Disables Cloud Services Following Disclosure of ‘Able2Shell’ Exploit Chains.”
• N-able status event 202609, opened 12 November 2026, 07:00 UTC (07:00 GMT).
• N-able, 11 November 2026. “Update on N-central 2026.4 HF2 and ongoing security response.”
• huntback, 12 November 2026. “4EverAble2Shell is already mining Monero on live N-central servers.”

Related stories

• ScreenConnect Partners Told to Avoid Sessions After SCKit is the nearest recent TSN account of advice to partners after flaws in a remote-management product.
• Attackers Are Exploiting an Ivanti Connect Secure Zero-Day, and CISA Gives US Agencies Until 16 October to Act
• Lumen Says Volt Typhoon Exploited at Least Four Zero-Days for Access