# New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access

Source: [The Hacker News](https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html) · 2026-11-12 · Security
Page: https://themorning.dev/story/new-n-central-exploits-work-against-patched-servers-enable-root-rce-and-windows-4fb3f4a554eb775b
Kind: security · Impact: high

## In brief

- N-able took hosted N-central environments offline after zero-day flaws in its RMM platform were publicly disclosed, and released hotfixes.
- A researcher's public disclosure included over 30 flaws, and N-able said it was investigating further claims affecting on-premise N-central 2026.4.1 HF2.
- The 4EverAble2Shell flaw is being exploited to deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, 19 of them on the latest hotfix.

## Why it matters

N-central is a remote monitoring and management platform, so compromising it can give attackers root or SYSTEM access and a path to the endpoints it manages.

## What to do

- Apply N-able's N-central hotfixes to on-premise servers
- Check N-central servers for signs of compromise, such as unexpected cryptocurrency miners

## Versions

- N-central 2026.4.1 HF2

## Timeline

- 2026-11-11: N-able takes hosted N-central environments offline and releases hotfixes for disclosed zero-days
- 2026-11-12: N-able says it is investigating a new public disclosure of additional N-central flaws
- 2026-11-12: 4EverAble2Shell proof-of-concept published and exploitation begins hours later
- 2026-11-12: N-able announces restrictions on certain N-central features and integrations

## Coverage

- [Hackers Exploit New N-central Zero-Day Hours After PoC Publication](https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/) — SecurityWeek, 2026-11-13
- [Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2](https://thehackernews.com/2026/11/hackers-exploit-n-central-flaws-to.html) — The Hacker News, 2026-11-13
- [New N-able "4EverAble2Shell" zero-day exploited hours after PoC released](https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/) — BleepingComputer, 2026-11-12
- [New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access](https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html) — The Hacker News, 2026-11-12
- [Hackers Target N-central Zero-Days as N-able Rushes Patches](https://www.securityweek.com/hackers-target-n-central-zero-days-as-n-able-rushes-patches/) — SecurityWeek, 2026-11-12
- [N-able Takes N-central Platform Offline After Discovery of 33 Flaws](https://www.darkreading.com/endpoint-security/n-able-n-central-offline-33-flaws) — darkreading, 2026-11-11
- [N-able releases security hotfixes for zero-day vulnerabilities](https://www.bleepingcomputer.com/news/security/n-able-releases-security-hotfixes-for-zero-day-vulnerabilities/) — BleepingComputer, 2026-11-11
- [N-able takes its remote access service offline after researcher publishes dozens of zero-day bugs](https://techcrunch.com/2026/11/10/n-able-takes-its-remote-access-service-offline-after-researcher-publishes-dozens-of-zero-day-bugs/) — TechCrunch, 2026-11-10
- [Critical vulnerabilities in N-able N-central prompt hosted shutdown](https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-n-able-n-central-prompt-hosted-shutdown) — Rapid7 Cybersecurity Blog, 2026-11-10
- [N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days](https://www.securityweek.com/n-able-takes-n-central-offline-as-researcher-drops-over-30-zero-days/) — SecurityWeek, 2026-11-10
- [N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits](https://thehackernews.com/2026/11/n-able-takes-hosted-n-central-offline.html) — The Hacker News, 2026-11-10
- [N-able takes cloud platform offline after 30+ "zero-days" published](https://www.bleepingcomputer.com/news/security/n-able-takes-cloud-platform-offline-after-30-plus-zero-days-published/) — BleepingComputer, 2026-11-09

Tags: zero-day, rmm, n-central, vulnerability, exploitation

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev