[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frbEKIYo_tRrn0gBsY4EcjGJdexEJcy8Lp4YW9bBpfus":3},{"article":4,"iocs":49,"watch_terms":56,"solutions":57,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"0b7ae7f0-77c5-45d1-a55d-5902811d5cf1","New N-able N-central Zero-Day Exploits Target Patched Servers, Claiming Unauthenticated Root Access","new-n-able-n-central-zero-day-exploits-target-patched-servers-claiming-unauthent-9455c1","New exploit code for N-able N-central has raised fresh concerns after researchers reported that servers running the latest emergency hotfix remain exposed. Published late on November 11, the tools, named 4EverAble2Shell and Agent2Shell, reportedly target N-central 2026.4 HF2, build 2026.4.1.26. Huntress reviewed the code and warned that fully patched servers should still be treated as […] The post New N-able N-central Zero-Day Exploits Target Patched Servers, Claiming Unauthenticated Root Access appeared first on Cyber Security News.","New exploit code for N-able N-central has emerged, targeting servers even after the application of the latest emergency hotfix. The exploits, named 4EverAble2Shell and Agent2Shell, reportedly allow unauthenticated root access and command execution on managed Windows devices. Huntress, which reviewed the code, warned that fully patched servers should still be considered vulnerable and advised customers to take N-central offline or remove internet access.","New N-able N-central zero-day exploits target patched servers, granting unauthenticated root access.","https:\u002F\u002Fcybersecuritynews.com\u002Fn-able-n-central-zero-day-exploits\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FN-able-N-central-zero-day-exploits-2.webp","2026-11-12T16:53:00+00:00","2026-11-12T17:00:26.169356+00:00",9,[17,20,23],{"name":18,"type":19},"N-able N-central","product",{"name":21,"type":22},"N-able","vendor",{"name":24,"type":25},"API","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"malware","4EverAble2Shell","Exploit tool name for N-able N-central.",{"type":51,"value":55,"context":53},"Agent2Shell",[21,18],{"controls":58,"vendors":146},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-private-access","Zscaler Private Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-private-access","Zero trust access to private applications, replacing VPN.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-access","Cloudflare Access","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Faccess\u002F","Zero trust access to internal applications without a VPN.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":118,"name":119,"problem":120,"products":121},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":163},"zero-day-bypasses-n-central-patch-exposing-root-access-on-managed-servers","Zero-Day Bypasses N-central Patch, Exposing Root Access on Managed Servers","Exploit code targeting N-able N-central emerged that bypasses the latest emergency hotfix, allowing unauthenticated attackers to gain root access and execute commands on managed Windows devices. This incident illustrates a critical gap in vulnerability management: patching alone cannot be treated as a complete remediation when active zero-day research is ongoing. The fact that fully patched servers remain exploitable means organizations must layer compensating controls—such as removing internet exposure—rather than relying solely on vendor hotfixes. Because N-central manages downstream Windows endpoints at scale, a single compromised server becomes a force-multiplier for attackers, making the blast radius exceptionally large. This underscores why internet-facing management platforms require especially aggressive network controls and continuous monitoring beyond the patch cycle.",[158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 12: Network Infrastructure Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA-05: Access Permissions and Authorizations","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":164,"NIST SP 800-53 SI-2: Flaw Remediation":165,"CIS Control 12: Network Infrastructure Management (v8)":166,"CIS Control 7: Continuous Vulnerability Management (v8)":167,"NIST CSF 2.0 PR.AA-05: Access Permissions and Authorizations":168},"NIS2 Article 21(2)(e) mandates vulnerability handling and disclosure practices in the acquisition and maintenance of systems, requiring entities to act when a vendor patch is proven ineffective against active exploits.","SI-2 requires organizations to identify when patches are ineffective and implement alternative mitigations, covering exactly the situation where the emergency hotfix did not prevent exploitation.","CIS Control 12 calls for restricting access to network management interfaces, which would have limited N-central's internet exposure and reduced the attack surface available to the unauthenticated exploit.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, including applying compensating controls when patches are insufficient—directly addressing the scenario where the N-central hotfix failed to close the vulnerability.","This category requires that access to critical systems be restricted to authorized users, which would have prevented the unauthenticated root access the exploits achieved against exposed N-central servers."]