hacker-news · Crawled Nov 13, 2026
New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
1 IoCs 1 CVEs
Read original article ↗
AI Summary
New exploits named 4EverAble2Shell and Agent2Shell have been disclosed against N-central on-premise servers, enabling unauthenticated remote code execution with root privileges and command execution as SYSTEM on Windows agents, respectively. These vulnerabilities affect patched versions, including build 2026.4.1.26, and rely on the non-default Legacy API being enabled. Probing activity has been observed from IP 157.20.241[.]16, leveraging the Apache Axis flaw CVE-2026-90436 for initial access, followed by attempts to exploit 4EverAble2Shell and download a malicious shell script.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 1 extracted
| Type | Value | Detail |
|---|---|---|
| IP | 157[.]20[.]241[.]16 | Details → |
MITRE ATT&CK TTPs 11 techniques
T1059.001 PowerShell · Execution T1059.004 Unix Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1095 Non-Application Layer Protocol · Command And Control T1134 Access Token Manipulation · Defense Evasion T1190 Exploit Public-Facing Application · Initial Access T1484.001 Group Policy Modification · Defense Evasion T1543.002 Systemd Service · Persistence T1570 Lateral Tool Transfer · Lateral Movement