What it is
VULN-2026-0009 is an unauthenticated vulnerability affecting N-able N-central.
Vulnerability report
Exploitation Attempts Observed
No CVE Assigned Yet
Confirmed Confidence
Not in CISA KEV
VULN-2026-0009
N-central Remote Code Execution
N-able / N-central
- Severity
- CVSS 9.8 · Critical
- Confidence
- Confirmed
- Exploit status
- Exploitation Attempts Observed in the Wild
- EPSS
- —
- First observed
- 12 Nov 2026
- Last observed
- 12 Nov 2026
Decision summary
What security teams need to know first
Direct answers before the deeper technical record.
Have exploitation attempts been observed?
Yes. Previdian sensors have observed 4 exploitation attempts, 1 unique attacker IP, and 1 country targeting VULN-2026-0009. First observed Nov 12, 2026. Confidence is confirmed.
Who is affected?
N-able / N-central.
What should we do?
Patch immediately, validate internet-facing exposure, and monitor for matching requests.
Overview
N-central Remote Code Execution
An unauthenticated exploit chain in N-able N-central, disclosed as 4EverAble2Shell, is reported to allow remote attackers to execute arbitrary operating-system commands with root privileges. The chain exploits unsafe class instantiation during SOAP fault processing in the bundled Apache Axis component. A crafted request causes an attacker-selected JLine class to process malicious input, resulting in command execution as the nable service account.
The published proof of concept then abuses separate weaknesses in N-central’s privileged helper functions to escalate execution to root. The researcher reports successful testing against N-central Appliance 2026.4.1.26 (HF2). The complete affected-version range and an N-central fixed build for this chain have not been verified.
- Published
- 12 Nov 2026
- Exploitation Attempts Reported
- 12 Nov 2026
- Attack vector
- Remote
- Complexity
- Low
- Privileges
- None
- User interaction
- None
Tags
apache
Exploitation evidence
Evidence of exploitation attempts
Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.
Exploitation Attempts Observed in the Wild
Previdian
Previdian sensors observed exploitation attempts targeting this vulnerability.
Exploitation Attempts Observed
Previdian sensor
Previdian sensors observed exploitation attempts targeting this vulnerability.
Proof of concept available
Public scanner or PoC coverage increases practical exploitability.
Known exploited vulnerability sources
Per-source evidence links for KEV attestations are available through the Previdian Pro API.
Learn about Pro API access| Source | Added |
|---|---|
| Previdian Sensors First | 2026-11-12 09:45 UTC |
Operational indicators for this CVE are listed under Detection.
Sensor telemetry
Previdian Sensor Observations
Previdian sensor observations are exploitation attempts targeting this vulnerability. They do not show that the target was vulnerable or that the attempt succeeded. The cards and chart show volume, unique attackers, and daily activity.
4
Attempts observed
1
Unique attacker IPs
1
Attacker countries
IN
1
Sensors observed
VULN-2026-0009 exploitation attempts over the last 7 days
Daily events observed by Previdian sensors
Updated 12 Nov 2026
6 Nov
7 Nov
8 Nov
9 Nov
10 Nov
11 Nov
12 Nov
First observed 12 Nov 2026 · Last observed 12 Nov 2026
Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.
Detection
Operational artifacts and observed signals
Make the evidence actionable in scanner, SOC, and edge-control workflows.
Observed signals
- Request targets
- User-Agents
- Callback hosts
- 1
- 2
- 0
Request targets and User-Agents available in Pro. Callback host details available in Enterprise.
Scanner coverage
No scanner integrations recorded yet.
Virtual patch status
No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.
Learn about virtual patches →Attacker IP Indicators
Attacker IP indicators observed · available in Pro and Enterprise.
Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.
Learn about Pro API accessRisk and context
Severity, weaknesses, and research context
CVSS v3.1
9.8
Critical
Potential damage if exploited. Separate from whether attackers are using it.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
—
Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.
Potential Proof of Concepts
These PoCs are unverified and could contain malware. Use at your own risk.
4EverAble2Shell
public · Created 2026-11-12 07:13:00 UTC
Timeline
From disclosure to observed exploitation attempts
-
08:24 UTC
Indicator of compromise added
Indicators of compromise recorded
-
08:24 UTC
Observed by Previdian sensors
Previdian sensors observed exploitation attempts targeting this vulnerability.
-
07:13 UTC
Public PoC available
Public proof-of-concept code published
-
06:13 UTC
Added to the Previdian watchlist
Pro and Enterprise Watch users had 4 hours of early warning before Previdian KEV.
-
06:12 UTC
VULN published
Vulnerability disclosed publicly
Pro API
Automate this intelligence
Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
- Evidence confidence and provenance
- First-party sensor telemetry
- PoC and scanner references
- Affected versions and enrichment
- Automation-ready JSON delivery
GET /api/v2/pro/kevs/VULN-2026-0009
Sample API response{
"cve_id": "VULN-2026-0009",
"confidence": "Confirmed",
"cvss_score": 9.8,
"cvss_estimated": false,
"epss_score": null,
"exploit_status": {
"exploited_in_the_wild": true,
"active_exploitation_observed": true
},
"sensor_telemetry": { "attempts": 4, "sensors": 1 }
}