New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access

Researcher Sean Bales has disclosed new N-central flaws, dubbed 4EverAble2Shell and Agent2Shell, whose proof-of-concept exploits work against the patched 2026.4 Hotfix 2 release: 4EverAble2Shell gives unauthenticated root remote code execution on servers where the non-default Legacy API is enabled and exposed to the internet, and Agent2Shell chains more than 10 zero-days to run commands on managed Windows agents as SYSTEM. N-able is investigating and urges customers to disable the Legacy API, and probing of internet-facing servers was observed within hours of the proof-of-concept release.