New N-central attack chains reach HF2 servers and Windows managed endpoints
A researcher published new exploit chains tested on N-central Appliance 2026.4.1.26 HF2. The server chain needs Legacy API enabled. Separate Windows Agent and Probe paths have their own prerequisites. Sensors saw attempts against the server path.
- Disclosed
- Nov 12, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Reachable N-central HF2 with Legacy API enabled, and connected Windows Agents or Probes meeting the disclosed conditions
- N-able · N-central · RMM · Windows
- In the wild
- Disputed
- Previdian observed attempts against sensors. Successful compromise is unconfirmed.
What happened
The researcher behind the earlier Able2Shell disclosure published additional chains tested on N-central Appliance 2026.4.1.26 HF2. In the server test, the attacker could reach a SOAP endpoint while Legacy API was enabled. The chain ran commands as the appliance service account and then used privileged helpers to reach root.
The separate Agent2Shell report documents Windows paths. The Reactive path needs the appliance ID and an online Agent with Reactive enabled. The researcher demonstrated command execution as SYSTEM. The Probe path also uses device and task data, an online Probe and an existing task controlled as an output carrier. Disabling Legacy API addresses the stated prerequisite for the server chain. Confirm separate guidance for the Windows paths before treating managed endpoints as protected.
Previdian reported two attempts against its sensors from one source IP. This establishes observed attempts against the server chain. No successful customer compromise or complete affected-version matrix was established from the sources, and no fixed build was verified for these new chains. Keep HF2 for the earlier fixes and apply the configuration and network controls while tracking further vendor guidance.
Crime-scene timeline
Nov 12, 2026
Researcher posts new server and Windows endpoint chains
The published tests name N-central Appliance 2026.4.1.26 HF2.
Nov 12, 07:48 UTC
Research repository records the server prerequisite
The 4EverAble2Shell test had Legacy API enabled.
Nov 12, 08:24 UTC
Previdian records attempts against its sensors
Its public report counts two attempts from one source IP, with no confirmed successful compromise.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Researcher’s 4EverAble2Shell reportPrimaryDocuments the tested server build, SOAP endpoint, root chain and Legacy API prerequisite.
- Researcher’s Agent2Shell reportPrimaryDocuments the tested build, device identifiers and distinct Windows Agent and Probe prerequisites.
- Researcher’s publication and correction historyPrimaryRecords the initial repository commits and the Legacy API clarification.
- N-able Legacy APIs documentationPrimaryLocates the setting that permits re-enabling deprecated APIs.
- N-able HF2 release notesPrimaryIdentifies HF2 as build 2026.4.1.26 and describes Agent and Probe rollout for the previous fixes.
- Previdian sensor observationsPrimaryFirst-party sensor report records two attempts from one source IP, with no evidence of success.