{"id":4281,"date":"2026-11-14T10:56:39","date_gmt":"2026-11-14T18:56:39","guid":{"rendered":"https:\/\/cyber.mag212.com\/n-able-n-central-able2shell-hf2-legacy-api\/"},"modified":"2026-11-14T10:56:39","modified_gmt":"2026-11-14T18:56:39","slug":"n-able-n-central-able2shell-hf2-legacy-api","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/n-able-n-central-able2shell-hf2-legacy-api\/","title":{"rendered":"N-able N-central After HF2: Able2Shell, 4EverAble2Shell and the Legacy API Question"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><em>From the <a href=\"https:\/\/cyber.mag212.com\/the-keys-were-already-inside-mag212-cyber-weekly-november-14-2026\/\">MAG212 CYBER Weekly, 14 November 2026<\/a>. Status labels: confirmed by vendor, reported by researchers, or unverified. Every command below is copied from official documentation and was <strong>not tested by MAG212<\/strong>; run it only on systems you are authorised to administer.<\/em><\/p>\n\n\n\n<p class=\"m2-status wp-block-paragraph\"><strong>Status:<\/strong> Vulnerabilities <strong>confirmed by vendor<\/strong>: HF2 fixes seven CVEs, and N-able acknowledges that 4EverAble2Shell and Agent2Shell depend on the Legacy API <sup><a href=\"#src-10\">[10]<\/a><\/sup>. <strong>Exploitation status is in conflict:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>N-able reported scanning activity but &#8220;no evidence that any customer environment had been successfully exploited&#8221;, and Huntress has seen no exploitation in partner environments <sup><a href=\"#src-10\">[10]<\/a><\/sup>.<\/li>\n\n<li>watchTowr saw exploitation <em>attempts<\/em> on honeypots <sup><a href=\"#src-9\">[9]<\/a><\/sup>.<\/li>\n\n<li>N-able&#8217;s own 13 November IoCs include XMRig-delivery infrastructure <sup><a href=\"#src-10\">[10]<\/a><\/sup>.<\/li>\n\n<li>The earlier draft&#8217;s claim of &#8220;live exploitation&#8221; (Huntback: 21 mining identities, 19 on HF2) is <strong>unverified<\/strong>, because the source could not be located.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">About 04:14 UTC on 9 November (the evening of 8 November in the Americas), a researcher published proof-of-concept code for 33 alleged N-central vulnerabilities (&#8220;Able2Shell&#8221;) without notifying the vendor. N-able took hosted N-central offline in the Americas, Europe and APAC and told on-premises customers to shut down. Censys counted <strong>1,728<\/strong> internet-reachable hosts that day <sup><a href=\"#src-9\">[9]<\/a><\/sup>. At 5:30 PM ET on 10 November, N-central 2026.4 HF2 (build 2026.4.1.26) fixed seven CVEs <sup><a href=\"#src-10\">[10]<\/a><\/sup>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CVE-2026-125883: XXE<\/li>\n\n<li>CVE-2026-125878: OGNL injection<\/li>\n\n<li>CVE-2026-125879: LPE to root via syslog-ng configuration<\/li>\n\n<li>CVE-2026-125880: stored XSS<\/li>\n\n<li>CVE-2026-125881: SSRF<\/li>\n\n<li>CVE-2026-125882: RCE via upload path traversal<\/li>\n\n<li>CVE-2026-91000: insecure IPC leading to LPE<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">At 1:10 AM ET on 12 November, the researcher released two more chains <sup><a href=\"#src-10\">[10]<\/a><\/sup>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>&#8220;4EverAble2Shell&#8221;:<\/strong> unauthenticated RCE to root on the N-central server, working against HF2.<\/li>\n\n<li><strong>&#8220;Agent2Shell&#8221;:<\/strong> more than 10 issues in server-to-Agent\/Probe communication, including two chains for unauthenticated command execution as SYSTEM on managed Windows endpoints.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">At 6:30 AM ET, N-able said both require the non-default <strong>Legacy API<\/strong> to be enabled and exposed, and that hosted N-central is not vulnerable to 4EverAble2Shell <sup><a href=\"#src-10\">[10]<\/a><\/sup>. N-able published IoCs at 10:25 AM ET on 13 November <sup><a href=\"#src-10\">[10]<\/a><\/sup>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Who is affected<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>4EverAble2Shell:<\/strong> on-premises N-central servers with the Legacy API enabled and reachable from the internet, <strong>including HF2 build 2026.4.1.26<\/strong>.<\/li>\n\n<li><strong>The seven HF2 CVEs:<\/strong> all builds before HF2.<\/li>\n\n<li><strong>Agent2Shell:<\/strong> managed Windows endpoints, where the Legacy API is enabled.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">No CVE IDs exist yet for 4EverAble2Shell or Agent2Shell, and MAG212 found no HF3 <sup><a href=\"#src-10\">[10]<\/a><\/sup>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why this matters<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An RMM server holds standing administrative access to every managed customer. Even with exploitation disputed, the combination of public PoCs, a fix that does not cover the newest chains and a non-default setting that decides exposure means MSPs must verify configuration, not just install a hotfix. Configuration drift, not missing patches, is the real risk here. <em>(MAG212 analysis)<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/n-able-n-central-able2shell-hf2-legacy-api-diagram.png\"><img decoding=\"async\" src=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/n-able-n-central-able2shell-hf2-legacy-api-diagram.png\" alt=\"Diagram of an N-central server with a Legacy API switch, showing hotfixed Able2Shell flaws, the 4EverAble2Shell path that works when the Legacy API is on, Agent2Shell commands to Windows endpoints, and outbound miner indicators.\"\/><\/a><figcaption class=\"wp-element-caption\">Diagram: MAG212 CYBER. Solid red = observed or vendor-confirmed; dashed amber = reported or unverified; green = recommended control.<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">How the attack works<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">These are researcher-described paths from published PoCs:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Unauthenticated SOAP request to the N-central server.<\/li>\n\n<li>Code execution as the service account.<\/li>\n\n<li>Escalation to root (one HF2 CVE covers LPE via syslog-ng config).<\/li>\n\n<li><em>Possible<\/em> abuse of the RMM channel to push commands to managed endpoints as SYSTEM (Agent2Shell).<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">N-able&#8217;s IoCs show a miner-delivery path (<code>jup.sh<\/code>, <code>xmrig.tgz<\/code>) on attacker infrastructure. Whether customer servers actually ran it is <strong>not established<\/strong> in the sources MAG212 could reach.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What defenders should look for<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><em>N-able IoCs, 13 Nov, defanged<\/em> <sup><a href=\"#src-10\">[10]<\/a><\/sup>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>URLs: <code>hxxp:\/\/157.20.241[.]16:8080\/jup.sh<\/code>, <code>\/xvgz<\/code>, <code>\/xmrig.tgz<\/code>, <code>\/ob\/cronhit?h=jup_start_&lt;rig&gt;&amp;persist=&lt;method&gt;<\/code>, <code>\/ob\/fcheck<\/code><\/li>\n\n<li>Outbound connections: <code>157.20.241[.]16<\/code> (ports 8080 and 19202\u201319418), <code>139.99.69[.]109:10128<\/code>, <code>79.76.51[.]56:39100<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Huntress static-analysis indicators<\/em> (not observed in the wild) <sup><a href=\"#src-10\">[10]<\/a><\/sup>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Server requests and files:<\/strong><ul><li>POSTs to <code>\/dms\/services\/ServerUI<\/code> containing <code>jline.internal.TerminalLineSettings<\/code> or <code>GenericAgentXMPPMessageExchange<\/code> with SessionID \u22121<\/li><li>POSTs to <code>\/dms2\/services2\/ServerMMS2<\/code> containing <code>RemoteExecutionTaskSubmit<\/code> with sessionID \u22121<\/li><li><code>\/var\/opt\/n-central\/flag\/flag_default.json<\/code> as a symlink to <code>\/opt\/nable\/var\/ncsai\/scripts\/ServerChild.sh<\/code><\/li><li><code>\/var\/opt\/n-central\/tmp\/serverchild-&lt;12hex&gt;.{bak,sh,out}<\/code><\/li><li>ZIPs under <code>\/download\/scheduled_tasks\/output_files\/<\/code> containing <code>CodeDropMeta.xml<\/code><\/li><\/ul><\/li>\n\n<li><strong>Windows endpoints:<\/strong><ul><li><code>powershell.exe -NoProfile -NonInteractive -EncodedCommand<\/code> running as SYSTEM, spawned by the N-able Agent<\/li><li><code>wsp.exe<\/code> or <code>service.cfg<\/code> written to <code>Windows Software Probe\\bin<\/code><\/li><li><code>taskkill \/f \/im wsp.exe<\/code> run from a <code>.cmd<\/code> file in <code>%TEMP%<\/code><\/li><\/ul><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>False positives.<\/em> RMM platforms legitimately run encoded PowerShell as SYSTEM, so match it against your scheduled automation before escalating. A single SOAP request can be a scanner probe.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Unverified (from the earlier draft only):<\/em> <code>\/tmp\/.xvd<\/code>, <code>\/var\/tmp\/.xvd<\/code>, <code>xvd.service<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to investigate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Follow Huntress&#8217;s guidance <sup><a href=\"#src-10\">[10]<\/a><\/sup>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Review activity <strong>from 11 November onward<\/strong> for unexpected admin accounts, scripts, scheduled tasks and remote sessions.<\/li>\n\n<li>Record the build, Legacy API status and the firewall\/ACL history for the exposure window.<\/li>\n\n<li>Group managed endpoints by customer and tenant, and review any script pushes that change tickets do not explain.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Contain and remediate (in order)<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Confirm the Legacy API is disabled, using N-able&#8217;s KB procedure. If it must stay enabled, do not expose it to the internet, and <strong>do not rely on IP allowlisting alone<\/strong> <sup><a href=\"#src-10\">[10]<\/a><\/sup>.<\/li>\n\n<li>Apply HF2.<\/li>\n\n<li>Upgrade Agents and Probes as well as servers, because HF2 changes how they communicate <sup><a href=\"#src-10\">[10]<\/a><\/sup>.<\/li>\n\n<li>Block and hunt the IoC addresses.<\/li>\n\n<li>If you find compromise, rebuild the server from trusted media and rotate RMM, integration and customer credentials from a clean control plane.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Verify recovery<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">N-able warned that a patched build <strong>may not change the version number<\/strong> <sup><a href=\"#src-9\">[9]<\/a><\/sup>, so confirm patch state with N-able rather than by version string. Test from an external vantage point that the Legacy API path is unreachable. Confirm Agents and Probes check in, then run a harmless approved job on one canary endpoint per tenant.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prevention and awareness<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">RMM consoles are a &#8220;keys to every customer&#8221; asset. Put them behind VPN or zero-trust access, log admin actions off-box, and give each MSP technician a separate identity protected by phishing-resistant MFA.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>No command panels.<\/em> No official N-able doc for checking or disabling the Legacy API was verified <sup><a href=\"#src-10\">[10]<\/a><\/sup>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Related on MAG212 CYBER<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyber.mag212.com\/the-keys-were-already-inside-mag212-cyber-weekly-november-14-2026\/\">MAG212 CYBER Weekly, 14 November 2026: The keys were already inside<\/a> (full issue and PDF)<\/li>\n\n<li><a href=\"https:\/\/cyber.mag212.com\/subscribe-free\/\">Subscribe free to MAG212 CYBER<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><span id=\"src-9\">[9]<\/span> Cloud Security Alliance Labs, &#8220;CSA research note: Able2Shell N-central zero-days&#8221;, 10 Nov 2026. <a href=\"https:\/\/labs.cloudsecurityalliance.org\/research\/csa-research-note-able2shell-ncentral-zero-days-20261110-csa\/\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-10\">[10]<\/span> Huntress, &#8220;N-able disables cloud services following disclosure of Able2Shell exploit chains&#8221;, 9 Nov, updated through 13 Nov 2026. <a href=\"https:\/\/huntress.com\/blog\/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Written and edited by El Mostafa Ouchen for MAG212 CYBER. Facts checked against the sources above as of 14 November 2026, 10:05 AM PST. Diagrams are original MAG212 CYBER illustrations.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>HF2 fixed seven N-central CVEs, then researchers showed chains that survive it wherever the Legacy API is on. What is confirmed, what is disputed, and what MSPs should do.<\/p>","protected":false},"author":1,"featured_media":4256,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,15,14],"tags":[362,363,345,346,347],"class_list":["post-4281","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-threat-intelligence","category-vulnerabilities","tag-able2shell","tag-msp","tag-n-able","tag-n-central","tag-rmm"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4281"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4281\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4256"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}