# N-able N-central "Able2Shell", "4EverAble2Shell" and "Agent2Shell" (Nov 2026): detection pack

**Pack version 1.3.0 (12 Nov 2026, sources checked 20:07 GMT).** 4EverAble2Shell is now **exploited in the wild**,
including on servers running the latest fix, N-central 2026.4 HF2 (build 2026.4.1.26), according to BleepingComputer
(12 Nov 2026, 19:51 GMT), which credits security researchers. N-able has **no fixed build** yet: its 12 Nov update says
it is developing additional remediation and restricting features in the meantime. The chain has no CVE or score of its
own; **Critical by impact** is our framing (unauthenticated root on the server, as reported). The only score in play is
CVSS 3.1 9.8 Critical, which CISA's enrichment gives to the Apache Axis 1.x flaw CVE-2026-90436 alone, not to the
chain. Everything from versions 1.2.0 and 1.1.0 still applies and is kept below.

> **Act now.** Confirm Legacy API is disabled on every on-premises N-central server (N-able's advice), keep the server
> off the internet (VPN or allowlist, OUR ADVICE), run the read-only checker with `--root /` on each server, and hunt
> from 11 Nov 2026 with KQL Q7 and Q8 to Q8h. Any hit on a NEWS IOC means the server is compromised at root: isolate,
> rebuild, rotate every credential and integration token, and review every action it pushed to managed devices.
> HF2 is still required for the seven HF2 CVEs, but a server on HF2 is not safe from 4EverAble2Shell.
>
> **Status of this pack.** The KQL in this pack has NOT been run against a live tenant. Neither has the converted
> Sigma in `sigma/converted/`. Test and tune them before you rely on them. The KQL parses cleanly against the table
> schemas we model, which is not the same as running it. N-able has published no indicators of compromise. The
> indicators here (one IP, one Java class, one systemd unit name, two paths) come from BleepingComputer, which credits
> security researchers; they are labelled NEWS IOC. Every other hunting pattern is our own and labelled OUR PATTERN.
> Items not confirmed by a source are marked [UNVERIFIED].
>
> **KEV and due dates.** None of the CVEs in this pack is in CISA's Known Exploited Vulnerabilities catalogue (latest
> catalogue 2026.11.10, checked 12 Nov 2026 20:07 GMT). Where KEV due dates exist, they bind US federal agencies only
> (BOD 26-04). Patch and mitigate now regardless of KEV status.

## Version 1.3.0: active exploitation (12 Nov 2026)

All times GMT (the same as UTC today). Sources fetched 12 Nov 2026 at 20:07 GMT: BleepingComputer's report, N-able's
Uptime dashboard data (incident 202613), the status.n-able.com feed and HF2 release notes, the NVD and cve.org records
for CVE-2026-90436 and the CISA KEV JSON feed.

| Item | Value | Source |
|---|---|---|
| Exploitation | "Hackers are actively exploiting" 4EverAble2Shell "to compromise servers and deploy cryptocurrency miners", with researchers reporting at least 21 affected systems, 19 of them running 2026.4.1.26 (HF2, released 10 Nov) | BleepingComputer, 12 Nov 2026 19:51 GMT |
| Timeline | Probing seen from about 08:30 UTC on 12 Nov, shortly after the public exploit code; attempts to run the full chain from 09:16 UTC; at 12:50 UTC researchers counted 21 active miners | BleepingComputer |
| How victims were counted | Researchers found infected servers through the attacker's mining pool statistics, where each miner's name starts `nc_` followed by the server's IP address, and confirmed all 21 were N-central servers | BleepingComputer |
| Where | Victims in the United States, Canada, South Africa, the United Kingdom, Germany, France and Sweden | BleepingComputer |
| Payload | A shell script that installed an XMRig Monero miner set to use about half of the CPU cores; the payload fetched the script from 157.20.241[.]16 and sent output back to the same address | BleepingComputer |
| Chain (summary) | Apache Axis CVE-2026-90436 for code execution as the `nable` service account, then a separate N-central privilege escalation to root. The escalation has no CVE in any source we checked | BleepingComputer; cve.org |
| Legacy API | The researcher says exploitation requires Legacy API to be enabled. N-able says Legacy API is turned off by default | BleepingComputer; N-able Uptime, incident 202613 |
| Indicators to check (NEWS IOC) | Suspicious requests to `/dms/services/ServerUI`, especially those referencing `jline.internal.TerminalLineSettings`; an unexpected `xvd.service` systemd unit; cryptocurrency mining processes; files under `/tmp/.xvd` or `/var/tmp/.xvd`; traffic with 157.20.241[.]16. Researchers say any of these means treating the server as fully compromised | BleepingComputer |
| Agent2Shell | BleepingComputer's report does not mention Agent2Shell being exploited. That is not evidence it is unexploited | BleepingComputer |
| N-able update | "November 12 Update: Critical N-central Security Update", incident 202613, start shown as 12 Nov 2026 16:00 (the dashboard does not state a time zone), status Identified: "We are restricting certain N-central features and integrations"; "we have seen no signs of compromise" (when written; exploitation was reported later that day by BleepingComputer, not by N-able) | N-able Uptime dashboard |
| Hosted | "N-able has applied these temporary protections directly to Hosted environments. No server-side action is required from Hosted customers." Intune integration turned off as a precaution. N-able does not say hosted servers are unaffected | N-able Uptime, incident 202613 |
| Fix | No fixed build. N-able: "Our teams are actively assessing the new disclosures, developing additional remediation". The status.n-able.com feed has no N-central release after the HF2 notes (10 Nov) | N-able Uptime; status.n-able.com feed |
| CVE-2026-90436 | Apache Axis 1.x (EOL), tagged unsupported when assigned; affects 1.4 and earlier; no Axis 1.x release will fix it. CVSS 3.1 9.8 from CISA's ADP enrichment (NVD shows it as Secondary); CISA SSVC Exploitation "none" (timestamp 10 Nov). NVD status now Awaiting Analysis, last modified 12 Nov 17:06 UTC. The record does not mention N-central | NVD API; cve.org record |
| CISA KEV | CVE-2026-90436 and the seven HF2 CVEs are not listed. Latest catalogue 2026.11.10 | CISA KEV JSON feed |

**N-able's advice (credited to N-able, verbatim from incident 202613 on the Uptime dashboard):**

* On-premises: "Ensure Legacy API access is disabled in your environment." "Legacy API access is disabled by default.
  If you enabled it, follow these instructions": N-able KB "How to Disable Legacy API settings on On-Premises N-central
  servers".
* "As a precaution, if you are running the Intune integration, we have temporarily deactivated it for you. If we were
  unable to execute this, our support team will make contact with you."
* "On-Premises customers should also continue to follow the previously communicated HF2 guidance, including upgrading
  their Agents and Probes." Hosted customers "should continue to follow our previous guidance to upgrade Agents and
  Probes".
* "Please continue to monitor this uptime dashboard."

**OUR ADVICE (1.3.0, CybaVerse, not from N-able):**

1. Treat every internet reachable on-premises N-central server as at risk, HF2 included. Put it behind a VPN or an IP
   allowlist now; N-able has not asked for this in its 12 Nov update.
2. Disable Legacy API and record that you did (`legacy_api` CSV column). Do not assume "off by default" means off.
3. Block 157.20.241[.]16 at the edge (N-able does not publish it; BleepingComputer reports it). One address is easy
   to change, so do not rely on the block.
4. Run `scripts/check-ncentral.sh --root /` (or `Check-NCentral.ps1 -Root /`) as root on each server. It only checks
   whether the news-sourced paths exist. Then run the KQL from 11 Nov 2026: Q7 and Q8 to Q8d (NEWS IOC), Q8e and Q8f
   (miner and CPU, OUR PATTERN), Q8g (NEWS, [UNVERIFIED] as telemetry) and Q8h (new outbound peers, OUR PATTERN).
5. Watch the Uptime dashboard for a fixed build and install it as soon as N-able publishes it.

**If anything matches a NEWS IOC (BleepingComputer says to treat it as a full compromise of the server; the steps are
OUR ADVICE):**

1. Isolate the server from the network (keep it powered on if you can, for evidence) and keep its logs and a disk
   image.
2. Rebuild it from known good media on a supported build; do not clean it in place, since the attacker had root.
3. Rotate every credential and integration token the server held or could reach: N-central admin and technician
   accounts, API and integration accounts (PSA, backup, Intune and any other connector), stored client credentials,
   and SSH keys.
4. Review every action it pushed to managed devices (scripts, jobs, software deployments, remote sessions) since
   8 Nov, using KQL Q6 to Q6e and Q7d, and start incident response for every client it manages.

**Corrections to the teammate brief (verified 12 Nov 2026, 20:07 GMT):**

* N-able's 12 Nov advisory is incident 202613 on the Uptime dashboard (uptime.n-able.com), not a post on
  status.n-able.com, which has nothing newer for N-central than the HF2 release notes.
* Exploitation data and every indicator come from BleepingComputer, crediting security researchers. N-able has not
  published any of them and said it had seen no signs of compromise when it wrote its update.
* Hosted: N-able's current wording is "temporary protections"; it does not say hosted servers are unaffected.
* The 9.8 is CISA's score for CVE-2026-90436 only. The chain is Critical by impact (our framing).
* "Needs the Legacy API enabled" is the researcher's statement as reported by BleepingComputer; N-able's update tells
  customers to ensure Legacy API is disabled without saying the issue depends on it.
* Blocking the IP and taking servers off direct internet exposure are OUR ADVICE, not N-able's.
* NVD's status for CVE-2026-90436 is now Awaiting Analysis (it was Received in 1.2.0).

**Unverified or dropped in 1.3.0:**

* [UNVERIFIED] The time zone of the 16:00 start shown for incident 202613; the time the exploit code was published.
* [UNVERIFIED] Whether `/dms/services/ServerUI` is governed by the LEGACY APIS setting.
* [UNVERIFIED] Whether the names of N-central components involved in the root step appear in process command lines
  (KQL Q8g).
* [UNVERIFIED] Where the `nc_` miner name appears on a victim (command line or config file).
* Not reported, so not used: miner file names, hashes, pool addresses, ports and process names. Q8e uses common miner
  traits and is labelled OUR PATTERN.
* Dropped: a tracking identifier one research firm gave the escalation flaw (it would identify the firm), and the
  step by step detail of the root step.

In line with our policy, research is credited to security researchers only. We name no researcher or firm, and we do
not link or name the public exploit code.

## Version 1.2.0: 4EverAble2Shell and Agent2Shell claims (12 Nov 2026, before exploitation was reported)

All times GMT. Sources fetched 12 Nov 2026 at 13:02 GMT and rechecked at 13:24 to 13:30 GMT: the Uptime incident
(still Investigating, one update), the N-able status feed, the KEV catalogue and the NVD record were unchanged. The
news report used in 1.2.0 was edited at 13:11 GMT with wording changes only. From 1.3.0 this pack cites only
BleepingComputer for news, so that outlet is no longer named or linked; its facts below are kept as history and are
superseded by the 1.3.0 section above where they differ.

| Item | Value | Source |
|---|---|---|
| N-able incident | "N-central Critical Security Incident - 2026.4.1 HF2 Release", opened 12 Nov 2026 07:00 GMT, status Investigating, impact Major Outage on N-central On-premise (Americas, APAC, Europe) | N-able Uptime page, incident 202609 |
| N-able statement | "N-able is investigating a new public disclosure containing claims of additional vulnerabilities in N-central On-Premises 2026.4.1 HF2." N-able is "assessing the claims, including which versions may be in scope" | Uptime, 07:00 GMT |
| Server issue and Legacy API | "Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet. Legacy API is turned off by default in the product and is not recommended." | Uptime, 07:00 GMT |
| Hosted | At 07:00 N-able wrote that hosted environments were unaffected by "this issue" (the server issue). Superseded: N-able's 12 Nov update (incident 202613, 16:00) says it has applied "temporary protections" to Hosted environments; see 1.3.0 | Uptime, 07:00 GMT |
| Agent2Shell | N-able's update does not mention Agent2Shell or managed agents. N-able has not said whether it depends on Legacy API, so we do not assume it does | Uptime, 07:00 GMT |
| Fix | None. No hotfix, build or CVE for either set | Uptime; N-able status feed |
| What is claimed [news] | 4EverAble2Shell: unauthenticated remote code execution as root on the server. Agent2Shell: more than ten flaws that run commands as NT AUTHORITY\SYSTEM on managed Windows agents if the attacker knows the appliance ID. Probes are not mentioned. Both claimed against fully patched HF2 | News report, 12 Nov 2026 11:51 GMT (no longer cited from 1.3.0) |
| Probing [news] | Targeted probing within hours of the public exploit code from 157.20.241[.]16, per a threat intelligence firm's telemetry. The attempted chain: CVE-2026-90436 (Apache Axis 1.x), then 4EverAble2Shell for root, then curl to fetch and run a shell script from the same address. "No evidence of successful exploitation" as of writing (superseded: exploitation is now reported, see 1.3.0). A security firm reported probes aimed at builds with Legacy API enabled | News report, 11:51 GMT (no longer cited; BleepingComputer confirms the IP in 1.3.0) |
| CVE-2026-90436 | Apache is the CNA. Published 6 Nov 2026 15:37 GMT, updated 10 Nov. "Apache Axis 1.x (EOL)", tagged UNSUPPORTED WHEN ASSIGNED; unauthenticated remote class instantiation via the SOAP fault exceptionName; affects 1.4 and earlier. No fixed release: Apache published a patch commit and "does not expect to create an Axis 1.x release". The CNA gives the text rating "critical" with no score; the CVSS 3.1 9.8 comes from CISA's ADP enrichment (NVD shows it as Secondary). CISA SSVC: Exploitation none, Automatable yes. NVD status Received | cve.org record; NVD API |
| N-central and Axis | [UNVERIFIED] N-able has not said that N-central uses Apache Axis 1.x or is affected by CVE-2026-90436 | none |
| CISA KEV | Neither CVE-2026-90436 nor the seven HF2 CVEs are listed. Latest catalogue 2026.11.10 (released 10 Nov 19:03 GMT) | CISA KEV JSON feed |
| N-able blog | "Update on N-central 2026.4 HF2 and ongoing security response", published 11 Nov 2026 21:26 GMT (modified 21:37). It predates the new claims and does not mention Legacy API | n-able.com blog |
| Legacy API setting | Administration > Mail and Network Settings > Network Security > LEGACY APIS. From 2025.4 the public SOAP EI API is not accessible unless re-enabled there; N-able warns "re-enabling these APIs will expose the N-central server to potential malicious exploits". The me.n-able.com Legacy API KB loads its text with script and was not readable to us; the path comes from N-able's 2025.4 release notes, developer docs and status post | N-able documentation |
| Legacy SOAP paths | N-able documents `/dms/services/ServerEI` (v1) and `/dms2/services2/ServerEI2` (v2) as SOAP EI endpoints | N-able troubleshooting KB |

**N-able's advice for the new claims (credited to N-able, verbatim from the Uptime page):**

* "If Legacy API is enabled: Disable Legacy API now."
* "All other customers: Confirm that Legacy API is disabled."
* From the 11 Nov blog (before the new claims): on-premises customers "should upgrade to HF2 as soon as possible and
  keep their servers inaccessible to the internet until the upgrade has been successfully completed", and "All
  customers, both hosted and on-premises, must also upgrade their Agents and Probes".

**OUR ADVICE (CybaVerse, not from N-able):**

1. Disable Legacy API. If an integration truly needs it, put the server behind a VPN or an IP allowlist so only that
   integration can reach it, and record why.
2. Keep the N-central admin interface and the agent communication interface off the public internet wherever your
   agent estate allows (VPN, allowlist or a reverse proxy that only passes agent traffic you expect).
3. Stay on HF2 (2026.4.1.26) and make sure Agents and Probes are upgraded too. Do not roll back.
4. Watch the N-able Uptime page for the next hotfix and for N-able's view on which versions are in scope.
5. Review reactively from 11 Nov 2026 00:00 GMT: KQL Q7 (news-sourced IP), Q7b to Q7f (our patterns), the checker
   `--log` IOC and Legacy SOAP EI lines, and the earlier Q1 to Q6e hunts.
6. Record the Legacy API state per server (`legacy_api` CSV column) and run the checker so nothing reads as fully
   patched by mistake.

**Corrections to the teammate brief (verified 12 Nov 2026):**

* The 1.2.0 news report did not say the exploit author confirmed Legacy API is required (BleepingComputer now reports
  that the researcher says it is; see 1.3.0). N-able says the server issue
  depends on Legacy API being on and exposed, after an initial review; a security firm reported Legacy API targeted
  probing.
* Probes are not mentioned in any source for Agent2Shell; only managed Windows agents are.
* "Affects fully patched HF2" is the researchers' claim. N-able is still assessing which versions are in scope.
* The 07:00 hosted wording covered "this issue" (the server issue), not Agent2Shell. Superseded: N-able now says it
  applied "temporary protections" to Hosted environments.
* CVE-2026-90436 was not "patched 6 Nov": Axis 1.x is end of life with no fixed release, and the 9.8 score is CISA
  ADP enrichment, not Apache's.
* The news-sourced IP 157.20.241[.]16 was in the 1.2.0 news report (confirmed then) and is in BleepingComputer's
  12 Nov report (confirmed for 1.3.0).
* The public exploit code time ("late 11 Nov") is [UNVERIFIED]; no source we can cite gives it.
* The Legacy API menu path is verified from N-able's 2025.4 documentation, since the KB itself was not readable.
* N-able's 11 Nov blog predates the new claims, so its advice covers HF2, not Legacy API.

**Unverified items:** the public exploit code time; whether N-central uses Apache Axis 1.x; whether Agent2Shell
depends on Legacy API; whether the LEGACY APIS setting governs `/dms/services/ServerEI` on HF2 (our inference, used in
Q7e and the checker log line); whether Probe processes are involved; where the setting is stored on the appliance
(N-able documents none, so the checkers take the value from you).

In line with our policy, research is credited to security researchers only. We name no researcher or firm and we do
not link or name the public exploit code.

## Version 1.1.0: where things stood after HF2 (checked 11 Nov 2026, 18:10 to 18:11 UTC)

| Item | Value | Source (fetch time, UTC) |
|---|---|---|
| Fix | N-central 2026.4 Hotfix 2, "Build Number: 2026.4.1.26", described as "a critical security update" | N-able "N-central 2026.4 HF2 Release Notes", status.n-able.com (18:10) |
| Release date | Post published 2026-11-10 20:48:08 UTC (page metadata and RSS feed). The page says "Last Updated: November 10th, 2026", but its metadata shows a modification at 2026-11-11 15:15:05 UTC; we cannot see what changed | status.n-able.com post and feed (18:10) |
| CVEs fixed | "The following CVEs have been released and fixed with the hotfix": CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, CVE-2026-91000 (table below). The Uptime page lists the same seven | HF2 release notes; N-able Uptime page (18:10) |
| Not everything is fixed | Uptime: HF2 is "the N-central release addressing the most critical November 9 vulnerabilities", and "a follow-up hotfix will be released to provide further security updates". No date given | N-able Uptime page (18:10) |
| Superseded builds | HF2 "supersedes N-central 2026.4 (build 2026.4.0.27) and N-central 2026.4 Hotfix 1 (build 2026.4.0.32)" | HF2 release notes |
| Other fixed branches | None. N-able names no fix on any other branch. Supported upgrade paths to HF2: 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 (Hotfix 1 to Hotfix 4), 2026.4.0.27, 2026.4.0.32. Earlier versions must first upgrade to a supported version | HF2 release notes |
| Agents and Probes | All customers, hosted and on-premises, must upgrade Agents and Probes (Agents first, then Probes); a Probe on 2026.4.1.26 cannot talk to older Agents or PME | HF2 release notes |
| Known issue | "Built-in remote control is temporarily disabled"; Take Control still works | HF2 release notes |
| Hosted | "All Hosted N-central servers (NCODs) across all global regions have been successfully upgraded", update posted 2026-11-11 01:04:27 UTC | N-able Uptime page (18:10) |
| On-premises | N-able "strongly recommends that all N-central On-Premises customers upgrade to the newly released version as soon as possible" and to keep servers offline "until your server has been successfully upgraded" | N-able Uptime page (18:10) |
| Exploitation | N-able: "We are now observing scanning activity associated with the published proof-of-concept code." N-able does not say any server was compromised. CISA's ADP enrichment on the CVE record rates CVE-2026-125883 SSVC Exploitation "poc", Automatable "yes"; CVE-2026-125879 and CVE-2026-91000 "none" | N-able Uptime page; cve.org records (18:10) |
| CISA KEV | None of the seven listed. Catalogue 2026.11.10 (released 2026-11-10 19:03 UTC, before the CVEs were published) | CISA KEV JSON feed (18:10) |
| NVD | All seven "Received", published 2026-11-10 22:18 to 22:21 UTC. Only N-able's CVSS v4.0 scores, shown as Secondary; no NVD assessment yet | NVD API (18:10) |

**The seven HF2 CVEs** (N-able is the CNA for all seven; CVSS v4.0 scores are N-able's, published 2026-11-10 21:19 to
21:26 UTC):

| CVE | N-able title | CWE (CNA) | CVSS v4.0 (CNA) | Affected per CVE record |
|---|---|---|---|---|
| CVE-2026-125883 | Multiple XXE Vulnerabilities | CWE-611 | 9.3 Critical (AV:N/PR:N) | before 26.4.1 |
| CVE-2026-125881 | Schema-hint SSRF via service import schema validation | CWE-918 | 9.3 Critical (AV:N/PR:N) | before 26.4.1 |
| CVE-2026-125878 | Multiple OGNL Injection vulnerabilities | CWE-79 | 8.7 High (AV:N/PR:L) | before 26.4.1 |
| CVE-2026-125879 | Local privilege escalation to root via nable-writable syslog-ng config | CWE-266 | 8.6 High (AV:N/PR:H) | before 26.4.1 |
| CVE-2026-125882 | RCE via file repository upload path traversal | CWE-23 | 8.6 High (AV:N/PR:H) | before 26.4.1 |
| CVE-2026-91000 | Insecure IPC Channels lead to local privilege escalation | CWE-306 | 8.4 High (AV:L/PR:L) | before 2026.4.1 |
| CVE-2026-125880 | Stored XSS via MMS3 patch metadata (admin context) | CWE-644 | 8.3 High (AV:N/PR:H/UI:A) | before 26.4.1 |

**Gaps and inconsistencies in N-able's own records (labelled, not resolved by us):**

* [GAP] No CVE record names build 2026.4.1.26. Six records say "before 26.4.1" and CVE-2026-91000 says "before
  2026.4.1" (version type "custom"). Only the release notes give the build. The checkers use the release notes
  build, 2026.4.1.26, and treat any lower build as vulnerable, including any 2026.4.1.x below .26 (none is published).
* [GAP] The CVE records link N-able security advisories on me.n-able.com. Those pages load their content with
  script and returned no advisory text to us, so we have not read them.
* [INCONSISTENT] CVE-2026-125878 is titled OGNL injection, but its record description and CWE say cross-site
  scripting (CWE-79); the advisory link name says the flaws "lead to RCE". CVE-2026-125879 is titled "Local", but
  its CVSS vector is AV:N. We report N-able's wording as published.
* [GAP] N-able does not say which of the 30 plus flaws reported in the news each CVE covers, nor what the follow-up
  hotfix will fix. Treat any disclosed flaw outside these seven as not confirmed fixed.

**What the research claims [UNVERIFIED - researcher claim, via news; not mapped to CVEs by N-able]:**

* An unauthenticated XXE in N-central's service import, chained to steal a trusted local session, reset an account
  password and run commands as the `nable` user. The same chain can create an enabled "Default Administrator" account
  with credentials the attacker picks.
* A stored XSS in patch metadata that runs commands as root when an administrator views it.
* A privilege escalation from code running as `nable` to root.
* Others reported in news: credential disclosure, arbitrary file write, path traversal, audit tampering, device
  impersonation. News reported 33 alleged flaws and at least four exploit chains; the researcher tested a pre-release
  build, 2026.4.0.31, which is not a build N-able names.

N-able credits one CVE to an external researcher; in line with our policy we do not name researchers or firms, and we
do not link the proof of concept.

## What to do now (HF2 advice from version 1.1.0, still valid)

**N-able's advice (vendor):**

1. On-premises: upgrade to N-central 2026.4 HF2 (2026.4.1.26) "as soon as possible", using the download and
   instructions in the HF2 release notes, and keep the server offline until it has been successfully upgraded.
2. Older versions: follow N-able's supported upgrade path (2025.4 or later can go straight to HF2; earlier versions
   must first upgrade to a supported version).
3. Hosted and on-premises: upgrade Agents and Probes, Agents first, then Probes. N-able has upgraded hosted servers.
4. Watch the Uptime page for the follow-up hotfix.

**Our advice (not from N-able):**

1. Find every N-central server you or your clients run, internet facing ones first (KQL Q1 to Q1d), then record
   host, build and exposure in a CSV and run the checker. Fix every VULNERABLE and EXPOSED / BUILD NOT CONFIRMED row.
2. Confirm the build on the server itself (the N-central UI or the appliance), not from an inventory tool alone.
3. Hunt from 8 Nov 2026 on the server and on managed endpoints (below), even after upgrading. Prioritise servers
   that were internet facing at any point before the upgrade.
4. Rotate N-central credentials (all admin and technician accounts, API and integration accounts) after upgrading
   and before restoring normal access.
5. Plan for the follow-up hotfix and for built-in remote control being off: check your fallback remote access.

**If you find signs of compromise (our advice):** isolate the server, keep its logs and a disk image, rotate N-central
credentials and every client credential it stores or could reach, and start incident response for every client the
server manages, since an attacker with control of N-central can push scripts and tools to all of them.

## Contents

| Path | What it is |
|---|---|
| `kql/n-able-ncentral-able2shell-hunting.kql` | Since 1.3.0: Q7 NEWS IOC 157.20.241[.]16 updated (BleepingComputer context, Syslog added); Q8 NEWS IOC web, proxy or WAF requests to `/dms/services/ServerUI` and any record with `jline.internal.TerminalLineSettings`; Q8b the same in Syslog; Q8c NEWS IOC `xvd.service` unit written, named or logged; Q8d NEWS IOC files and processes under `/tmp/.xvd` or `/var/tmp/.xvd`; Q8e OUR PATTERN miner processes and stratum pool traffic (plus the news-sourced `nc_` miner name); Q8f OUR PATTERN sustained high CPU (Perf or InsightsMetrics); Q8g NEWS [UNVERIFIED as telemetry] new command lines naming N-central components reported in the root step; Q8h OUR PATTERN new public outbound peers from the server. Since 1.2.0: Q7 IOC (news-sourced) 157.20.241[.]16 in network, firewall, gateway and command line data; Q7b OUR PATTERN server running curl, wget or sh as root; Q7c OUR PATTERN new files on the appliance; Q7d OUR PATTERN agent starting cmd or PowerShell as SYSTEM versus a 30 day baseline; Q7e OUR PATTERN [UNVERIFIED] Legacy SOAP EI requests; Q7f OUR PATTERN agents reaching public IPs other than your N-central servers. From 1.1.0: Q1 to Q1d inventory and exposure; Q2, Q2b web requests to legacy SOAP and applianceLog paths; Q3 audit records (Default Administrator, password resets, accounts created or enabled); Q4, Q4b processes as nable or root on the server; Q5 file writes in web folders; Q6 to Q6e managed endpoints (agent launched scripts and tools versus a 30 day baseline, second hop, new files, new local accounts, new remote access tools) |
| `sigma/*.yml` | 14 rules. New in 1.3.0 (NEWS IOC unless stated): `jline.internal.TerminalLineSettings` keyword (webserver), `/dms/services/ServerUI` v1 request (webserver), `xvd.service` or `.xvd` path written (linux file_event), process from a `.xvd` path or naming `xvd.service`, plus OUR PATTERN miner traits (linux process_creation); the two IP rules now cite BleepingComputer. New in 1.2.0: news-sourced IP connection (network_connection), Linux download tool or shell with the news-sourced IP (linux process_creation), agent starting cmd or PowerShell with download, encoded or account commands (windows process_creation, OUR PATTERN), Legacy SOAP EI v1 request (webserver, OUR PATTERN [UNVERIFIED]). From 1.1.0: agent spawning script interpreters (windows process_creation), agent child adding users or downloading (windows process_creation), shell as nable (linux process_creation), JSP or script written under web folders (linux file_event), applianceLog request (webserver), legacy UI SOAP request (webserver) |
| `sigma/converted/` | Kusto output for no pipeline, microsoft_xdr, microsoft_365_defender, sentinel_asim and azure_monitor |
| `scripts/check-ncentral.sh`, `scripts/Check-NCentral.ps1` | Read-only offline checkers with identical output and exit codes; at 2026.4.1.26 or later they report the seven HF2 CVEs as patched and the new issues as unpatched, with the Legacy API state you record. Since 1.3.0: `--root` / `-Root` checks for the `xvd.service` unit and the `.xvd` paths (exit 7), and `--log` flags the Java class and `/dms/services/ServerUI` requests |
| `tests/` | Bash tests, Pester tests (including bash vs PowerShell parity), synthetic fixtures (including `root_hit/`, `root_clean/`, `root_userunit/` folder trees and `access_4ever.log`), `run_all.sh`, `gates.sh` (static gates), `negative_gates.sh` (plants faults and checks the gates catch them), `kql_parse.ps1` (KQL parse check), `sigma_convert.sh` (regenerates `sigma/converted/`) |

### Sigma conversion (sigma-cli 3.1.0, pySigma Kusto backend)

`sigma check`: 0 errors, 0 condition errors, 0 issues.

* The two Windows rules convert on every pipeline. `microsoft_xdr` and `microsoft_365_defender` map them to
  `DeviceProcessEvents` (ParentImage becomes `InitiatingProcessFolderPath`); `sentinel_asim` maps to `imProcessCreate`;
  `azure_monitor` maps to `SecurityEvent` (needs process creation event 4688 with command line logging).
* The two Linux rules convert on every pipeline. `microsoft_xdr` and `microsoft_365_defender` map them to
  `DeviceProcessEvents` and `DeviceFileEvents`; `sentinel_asim` maps them to `imProcessCreate` and `imFileEvent`.
  Caveat: `azure_monitor` maps them to `SecurityEvent`, a Windows table, so that output is not usable for Linux hosts.
  They also need a Linux sensor on the N-central appliance, which many MSPs will not have.
* New in 1.2.0: the news-sourced IP rule converts on `microsoft_xdr` and `microsoft_365_defender`
  (`DeviceNetworkEvents`, RemoteIP or LocalIP) and `azure_monitor` (`SecurityEvent`), and fails on `sentinel_asim`
  (`SourceIp` is not a supported field for `imNetworkSession`); use KQL Q7 there. The Linux IOC rule and the Windows
  agent rule convert on every pipeline (same Linux caveat for `azure_monitor` as below). The Legacy SOAP EI rule
  fails like the other webserver rules.
* The webserver rules (three since 1.2.0) fail on `microsoft_xdr`, `microsoft_365_defender` and `azure_monitor` ("Unable to determine
  table name from rule") and on `sentinel_asim` (`cs-uri-stem` is not a supported field). They convert only without a
  pipeline, as bare field expressions you must point at your own table. Use KQL Q2, Q2b and Q7e instead.

* New in 1.3.0: the file_event and process_creation rules convert on `microsoft_xdr` and `microsoft_365_defender`
  (`DeviceFileEvents`, `DeviceProcessEvents`) and `sentinel_asim` (`imFileEvent`, `imProcessCreate`); `azure_monitor`
  maps them to `SecurityEvent`, which is not usable for Linux. The two new webserver rules fail like the others,
  except that `sentinel_asim` turns the keyword rule into `imWebSession | where "jline..."`, which is not a usable
  filter. Use KQL Q8 and Q8b for web data.

## Hunting notes (our patterns, not N-able indicators)

**On the N-central server**

* Web requests (Q2, Q2b, checker `--log`). [UNVERIFIED - public research] Published research on earlier N-central
  flaws (CVE-2025-9316, CVE-2025-11700) used the legacy SOAP services `/dms/services/ServerMMS` and
  `/dms/services/ServerUI` (and `/dms2/services2/ServerMMS2`, `ServerUI2`) and wrote content to
  `/opt/nable/webapps/ROOT/applianceLog/`. News summaries of Able2Shell describe an anonymous MMS2 session, service
  import XXE and a JSP file being written and run. Agents talk to the MMS service all day, so our signals are one
  source getting 2xx from both MMS and UI services, and any request under `/applianceLog/`. Access logs do not show
  the SOAP method or body, so these are leads, not proof.
* Accounts (Q3, checker `--audit`). Look for "Default Administrator" being created or enabled [news], password resets
  nobody asked for, and new or re-enabled admin accounts from 8 Nov. [UNVERIFIED] N-central audit export and syslog
  wording vary; the checker and Q3 use simple keywords.
* Processes (Q4, Q4b). Unexpected shells or tools run as `nable` or root [UNVERIFIED - researcher claim, via news].
* Files (Q5). New `.jsp`, `.jspx`, `.war`, `.class` or scripts under `/opt/nable/webapps/` or `applianceLog`
  [UNVERIFIED - public research for the paths].

**New in 1.2.0 (from 11 Nov 2026 00:00 GMT, `NewHuntStart` in the KQL)**

* Q7 NEWS IOC (BleepingComputer 12 Nov 2026 since 1.3.0): any traffic to or from 157.20.241[.]16, and command lines that
  contain it. It is the only external indicator in this pack and it is not from N-able. One address is easy to change;
  absence proves nothing.
* Q7b OUR PATTERN: curl, wget or sh run as root on the N-central server, the reported last step of the chain. Needs a
  Linux sensor on the appliance.
* Q7c OUR PATTERN: new files in temporary folders, `/opt/nable`, cron, systemd units and `.ssh` on the appliance.
* Q7d OUR PATTERN (Agent2Shell): `agent.exe`, `AgentMaint.exe` or `msp-agent-core.exe` (names already in this pack;
  the last one is [UNVERIFIED - community RMM catalogue]) starting cmd, PowerShell or pwsh as SYSTEM, scored against
  the 30 days before 11 Nov. We do not know Probe process names well enough to hunt them, so Probes are not covered.
* Q7e OUR PATTERN [UNVERIFIED]: requests to `/dms/services/ServerEI` or `/dms2/services2/ServerEI2` (paths documented
  by N-able) in CEF or Application Gateway logs. That the LEGACY APIS setting governs them, and that the exploit uses
  them, is our inference. A 2xx answer on the v1 path suggests Legacy API is on.
* Q7f OUR PATTERN: managed agents connecting to public IPs other than the N-central servers you list in `NcServerIPs`.

**New in 1.3.0 (from 11 Nov 2026 00:00 GMT; first probing reported at about 08:30 UTC on 12 Nov, `ExploitSeen`)**

* Q8 and Q8b NEWS IOC: `/dms/services/ServerUI` requests (any status, since a failed request can still be an
  attempt) and any record containing `jline.internal.TerminalLineSettings`. Access logs rarely hold request bodies,
  so the class name usually shows only in WAF match data. A ServerUI request on its own is a lead.
* Q8c NEWS IOC: `xvd.service` written as a file, named in a command line or logged by systemd. The folder it was
  written to is not reported; the checker looks in the standard systemd unit folders (our choice).
* Q8d NEWS IOC: anything written to, run from or naming `/tmp/.xvd` or `/var/tmp/.xvd`.
* Q8e OUR PATTERN: XMRig was reported, but no file name, hash, pool or port. We look for the name `xmrig`, stratum
  URLs and two XMRig options, plus the news-sourced `nc_<server IP>` miner name [UNVERIFIED where it appears].
* Q8f OUR PATTERN: the miner was set to about half the cores, so look for hours of CPU well above the server's own
  baseline (our thresholds: at least 40 percent and 25 points above the 7 day baseline, for 3 or more hours).
* Q8g NEWS [UNVERIFIED as telemetry]: security researchers name two N-central components in the root step. Normal
  operation may use them; the hunt shows only command lines new versus the 30 days before 11 Nov.
* Q8h OUR PATTERN: the payload called back to the attacker and the miner reaches a pool, so new public outbound peers
  from the server since 11 Nov need explaining.

**On managed endpoints (where most MSPs have Defender)**

* Q6 lists scripts and tools launched by the N-central Windows Agent (`agent.exe` or `AgentMaint.exe` in
  `\N-able Technologies\Windows Agent\bin\`, per N-able documentation) since 8 Nov that do not match anything the agent
  ran in the 30 days before. Q6b looks one hop further (agent > cmd > tool). Q6c lists new executables and scripts
  written by the agent tree. Q6d lists new local accounts. Q6e lists remote access tools new to a device.
  [UNVERIFIED - community RMM catalogue] MSP Agent (`msp-agent-core.exe`) and Take Control helper names.
* N-able took hosted N-central offline on 9 Nov while Ecoverse scripting stayed up, and reported all hosted servers
  upgraded to HF2 at 01:04 UTC on 11 Nov. Agent driven activity in that window should map to an on-premises server
  or an Ecoverse job you ran.

## Checkers

Strictly read-only. They read files you supply and their arguments; they do not contact N-central, open sockets, run
other programs or write files. No payloads. The fixed build is `FIX_BUILD` (bash) and `$FixBuild` (PowerShell),
set to 2026.4.1.26 from N-able's HF2 release notes, with the seven HF2 CVEs in `FIX_CVES` and `$FixCves`.

* A full build (four numbers, such as 2026.4.1.26) at or above 2026.4.1.26 no longer reads as fully patched. Since
  1.2.0 the verdict starts `PATCHED (HF2 CVEs); NEW UNPATCHED ISSUES (4EverAble2Shell/Agent2Shell):` followed by
  `LEGACY API ENABLED` (exit 1), `Legacy API recorded disabled` (exit 3) or `check Legacy API` (exit 6). It covers
  the seven HF2 CVEs only, and reminds you about the follow-up hotfix, Agents and Probes, and hunting.
* Legacy API state is an operator value. N-able documents the setting in the UI (Administration > Mail and Network
  Settings > Network Security > LEGACY APIS) but no file or database location, so the checkers cannot read it and the
  location on the appliance is UNVERIFIED. Supply what you see in the UI with `--legacy-api` / `-LegacyApi` or an
  optional fourth CSV column `legacy_api`: `enabled`, `on`, `yes`, `true` or `1`; `disabled`, `off`, `no`, `false` or
  `0`; empty means not recorded. Enabled raises any row to exit 1. A value that is not recognised is reported.
* A build that is clearly lower (for example 2026.4.0.32, 2026.3.1.14 or 2025.4) is `VULNERABLE`, whatever the
  exposure; the advice text changes with the exposure value.
* A missing or partial build (such as `2026.4`, `2026.4.1`, or the CVE record notation `26.4.1`) is not enough to
  decide, so the exposure value decides as before: `EXPOSED / BUILD NOT CONFIRMED`, `OFFLINE/NOT EXPOSED` or
  `UNKNOWN`. A partial build is never reported as patched.
* Known N-able builds are labelled in the output: 2026.4.0.27 (2026.4), 2026.4.0.32 (2026.4 HF1), 2026.4.1.26
  (2026.4 HF2). Leading and trailing spaces in the version are ignored.

```
# Inventory CSV you build yourself. Header: host,version,internet_exposed[,legacy_api]   (# lines skipped)
bash scripts/check-ncentral.sh --csv inventory.csv [--log access.log ...] [--audit audit-export.csv ...] [--extra-ip 192.0.2.10]
bash scripts/check-ncentral.sh --host nc01 --exposed yes --version 2026.4.1.26 --legacy-api disabled
pwsh -File scripts/Check-NCentral.ps1 -Csv inventory.csv -Log access1.log,access2.log -Audit audit-export.csv -ExtraIp 192.0.2.10
pwsh -File scripts/Check-NCentral.ps1 -HostName nc01 -Exposed yes -Version 2026.4.1.26 -LegacyApi disabled
sudo bash scripts/check-ncentral.sh --root /            # on the N-central server itself (read-only)
bash scripts/check-ncentral.sh --root /mnt/nc01-image   # or against a read-only mounted disk image
```

| Exit | Verdict | Meaning |
|---|---|---|
| 0 | OFFLINE/NOT EXPOSED | Build missing or partial, and recorded as offline or not internet exposed. Confirm the build |
| 1 | VULNERABLE | Full build below 2026.4.1.26, any exposure. Upgrade now |
| 1 | EXPOSED / BUILD NOT CONFIRMED | Build missing or partial, and recorded as internet exposed |
| 1 | LEGACY API ENABLED | Legacy API recorded as enabled, on any row. Disable it now (N-able's advice) and hunt from 11 Nov |
| 2 | UNKNOWN | Build missing or partial and exposure value not recognised; also `--log`, `--audit` or `--root` alone with no hits |
| 3 | PATCHED (HF2 CVEs); NEW UNPATCHED ISSUES ...: Legacy API recorded disabled | Full build 2026.4.1.26 or later and Legacy API recorded disabled. Fixed for the seven HF2 CVEs only; the new issues have no fix, and N-able has not said whether Agent2Shell depends on Legacy API; still hunt |
| 4 | LOG REVIEW | Our log or audit patterns or a news-sourced log indicator matched (overrides the inventory verdict; overridden by 7) |
| 5 | Usage or read error | |
| 6 | PATCHED (HF2 CVEs); NEW UNPATCHED ISSUES ...: check Legacy API | Full build 2026.4.1.26 or later, Legacy API not recorded. Check the setting and record it |
| 7 | HOST ARTIFACT FOUND | Since 1.3.0. `--root` / `-Root` found an `xvd.service` unit or a `/tmp/.xvd` or `/var/tmp/.xvd` path (NEWS IOC, BleepingComputer). Overrides every other verdict except 5. Treat the server as fully compromised: isolate, rebuild, rotate every credential and integration token, review what it pushed to managed devices |

CSV mode exits with the worst row (1 > 2 > 6 > 0 > 3), so exit 3 means every row is on HF2 with Legacy API recorded
disabled. `--log` reads a combined format access log and reports any request under `/applianceLog/`, any source with
2xx responses from both MMS and UI SOAP services, since 1.2.0 any line containing the news-sourced IP 157.20.241[.]16
(or an IPv4 you add with `--extra-ip` / `-ExtraIp`), and 2xx requests to `/dms/services/ServerEI` (path documented by
N-able; its link to the LEGACY APIS setting is UNVERIFIED). `--audit` reads any saved text or CSV export and reports lines mentioning "Default Administrator",
password resets, or accounts created, added or enabled. When N-able publishes the follow-up hotfix, update
`FIX_BUILD`/`$FixBuild` and the CVE lists only from N-able's own release notes, in both checkers, and the guard in
`tests/run_all.sh`.

`--root DIR` / `-Root DIR` (since 1.3.0) tests whether these paths exist under DIR, without following links, reading
or printing file contents: `xvd.service` in `etc/systemd/system`, `run/systemd/system`, `lib/systemd/system`,
`usr/lib/systemd/system`, `usr/local/lib/systemd/system`, `etc/systemd/user`, `usr/lib/systemd/user` and
`root/.config/systemd/user` (the standard systemd unit folders, our choice) and in any `*.wants` folder inside them,
plus `tmp/.xvd` and `var/tmp/.xvd`. Each hit names the path and whether it is a file, directory or symlink. Run it as
root on the server so every folder is readable; a folder it cannot read is silently skipped by the operating system,
which is one more reason absence proves nothing. `--log` also reports, since 1.3.0, any line containing
`jline.internal.TerminalLineSettings` (any case, anywhere in the line) and any request to `/dms/services/ServerUI`
(the v1 path, any status), both labelled with BleepingComputer as the source.

## Testing

`tests/run_all.sh` runs shellcheck, PSScriptAnalyzer, the bash tests, the Pester tests (including bash vs PowerShell
parity), the static gates in `tests/gates.sh` (since 1.3.0 also: Q8 to Q8h labels, the new indicators identical in
the KQL, both checkers, Sigma and this README, identical systemd unit folders in both checkers, exit 7 documented,
sources limited to BleepingComputer, N-able, NVD, cve.org, CISA and MITRE, BOD 26-04 cited and the revoked earlier directive absent, and
the 1.3.0 README facts and response steps), then `tests/negative_gates.sh`, which copies the pack to a private
temporary folder, plants one fault at a time (an em dash, a banned name, a citation of the revoked directive, a missing indicator, an unlabelled
hunt, a non RFC 5737 fixture IP, an unapproved source link, a write primitive in a checker and more) and fails unless
`gates.sh` rejects every one. Earlier guards (no network, write or exec primitives in scripts, fixtures marked `FIXTURE_ONLY` with RFC 5737 IPs
only, KQL IPs limited to RFC 5737 placeholders plus the one news-sourced IOC in Q7, the IOC identical in both
checkers, the KQL and this README, no em or en dashes, banned names checked by sha256, no exploit code links, severity
wording, fix build 2026.4.1.26 and the seven HF2 CVEs identical in both checkers), the KQL parse check, both checkers
inside a bwrap sandbox with no network and a read-only filesystem with a sha256 before and after check of the pack
(including the new exit 3 and 6 cases and the Legacy API fixtures), and `sigma check` plus a comparison of fresh
conversions with `sigma/converted/` (`REGEN=1` rewrites them). It stops at the first failure. Fixtures cover builds
on both sides of the fix (`inv_hf2.csv`, `inv_patched_only.csv`), partial builds, the `legacy_api` column
(`inv_legacy.csv`, `inv_legacy_patched_off.csv`, `inv_hf2_nolegacy_crlf.csv`) and IOC and Legacy SOAP EI log lines
(`access_legacy.log`). The fixtures are synthetic; no fixture contains an
exploit request body or payload.

## ATT&CK mapping (MITRE)

T1190 Exploit Public-Facing Application, T1078.001 Valid Accounts: Default Accounts, T1098 Account Manipulation,
T1136.001 Create Account: Local Account, T1068 Exploitation for Privilege Escalation, T1505.003 Web Shell,
T1059.004 Unix Shell, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1072 Software Deployment Tools,
T1219 Remote Access Tools, T1105 Ingress Tool Transfer. Since 1.3.0: T1496 Resource Hijacking, T1543.002 Create or
Modify System Process: Systemd Service.

## Sources

Added in 1.3.0 (fetched 12 Nov 2026 20:07 GMT):

* BleepingComputer, "New N-able 4EverAble2Shell zero-day exploited hours after PoC released" (12 Nov 2026 19:51 GMT),
  the source of every NEWS IOC in this pack: https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/
* N-able Uptime dashboard, incident 202613 "November 12 Update: Critical N-central Security Update": https://uptime.n-able.com/
* N-able status and release notes feed (no N-central release after HF2): https://status.n-able.com/feed/
* NVD and cve.org, CVE-2026-90436 (rechecked): https://nvd.nist.gov/vuln/detail/CVE-2026-90436 , https://www.cve.org/CVERecord?id=CVE-2026-90436
* CISA KEV JSON feed (catalogue 2026.11.10): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
* MITRE ATT&CK T1496 and T1543.002: https://attack.mitre.org/techniques/T1496/ , https://attack.mitre.org/techniques/T1543/002/

Primary (added in 1.2.0, fetched 12 Nov 2026 from 13:02 GMT):

* N-able Uptime page, incident 202609 "N-central Critical Security Incident - 2026.4.1 HF2 Release": https://uptime.n-able.com/
* N-able blog, "Update on N-central 2026.4 HF2 and ongoing security response" (11 Nov 2026): https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response
* N-able developer docs, SOAP API (legacy): https://developer.n-able.com/n-central/docs/soap-api-legacy
* N-able status post, N-central 2025.4 GA (12 Nov 2025): https://status.n-able.com/2025/11/12/announcing-the-ga-of-n-central-2025-4/
* N-able KB "How to Disable Legacy API settings on On-premise N-central servers" (linked from the Uptime incident; loads by script, text not readable to us): https://me.n-able.com/s/article/How-to-Disable-Legacy-API-settings-on-On-premise-N-central-servers
* N-able N-central 2025.4 release notes (Legacy API setting path): https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2025.4_Release_Notes.htm
* N-able troubleshooting KB (SOAP EI endpoints): https://documentation.n-able.com/N-central/troubleshooting/Content/kb/How-to-get-last-scan-time-for-a-device-from-N-central-API-using-SOAP-calls.htm
* cve.org and NVD, CVE-2026-90436: https://www.cve.org/CVERecord?id=CVE-2026-90436 , https://nvd.nist.gov/vuln/detail/CVE-2026-90436
* CISA KEV JSON feed (catalogue 2026.11.10)

Primary (version 1.1.0):

* N-able "N-central 2026.4 HF2 Release Notes": https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/
  (fetched 11 Nov 2026 18:10 UTC)
* N-able Uptime page (incident updates): https://uptime.n-able.com/ (fetched 9 Nov 22:15 and 22:25 UTC, and 11 Nov
  18:10 UTC)
* N-able status and release notes feed: https://status.n-able.com/feed/ (fetched 11 Nov 18:10 UTC)
* N-able security advisories linked from the CVE records (content not readable to us, see gaps):
  https://me.n-able.com/s/security-advisory/aArVy0000002ihhKAA/cve2026125883-multiple-xxe-vulnerabilities
* cve.org records: https://www.cve.org/CVERecord?id=CVE-2026-125883 , https://www.cve.org/CVERecord?id=CVE-2026-125878 ,
  https://www.cve.org/CVERecord?id=CVE-2026-125879 , https://www.cve.org/CVERecord?id=CVE-2026-125880 ,
  https://www.cve.org/CVERecord?id=CVE-2026-125881 , https://www.cve.org/CVERecord?id=CVE-2026-125882 ,
  https://www.cve.org/CVERecord?id=CVE-2026-91000 (fetched 11 Nov 18:10 UTC)
* NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-125883 and the same path for the other six (fetched 11 Nov 18:10 UTC)
* N-able docs, Windows Agent paths: https://documentation.n-able.com/N-central/troubleshooting/Content/kb/How-to-ghost-or-clone-a-PC-with-a-Windows-Agent.htm
* N-able docs, n-able.app overview: https://documentation.n-able.com/N-central/userguide/Content/Ecoverse-views/n-able-app-overview.htm
* NVD records for earlier N-central flaws: https://nvd.nist.gov/vuln/detail/CVE-2025-11700 ,
  https://nvd.nist.gov/vuln/detail/CVE-2025-9316 , https://nvd.nist.gov/vuln/detail/CVE-2026-86218
* CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (JSON feed, catalogue 2026.11.10)
* MITRE ATT&CK: https://attack.mitre.org/

News (secondary context only, not used for build, date or CVE facts; since 1.3.0 BleepingComputer is the only
outlet cited):

* BleepingComputer: https://www.bleepingcomputer.com/news/security/n-able-takes-cloud-platform-offline-after-30-plus-zero-days-published/

Research credited to security researchers. We do not name them and we do not link the proof of concept.

## Changelog

* 1.3.0 (12 Nov 2026): BleepingComputer reports 4EverAble2Shell exploited in the wild from 12 Nov, including on HF2
  (19 of at least 21 servers), crediting security researchers; N-able's incident 202613 says Legacy API must be
  disabled, Intune integration is deactivated as a precaution, hosted environments have temporary protections, no
  compromise was seen when written, and remediation is still being developed (no fixed build). README: new 1.3.0
  section with verified facts, N-able's advice (credited), OUR ADVICE (labelled), response steps for any hit,
  corrections, unverified and dropped items, KEV caveat citing BOD 26-04. KQL: Q7 updated; new Q8, Q8b, Q8c, Q8d,
  Q8e, Q8f, Q8g, Q8h. Sigma: four new rules; the two IP rules re-sourced to BleepingComputer. Checkers: `--root` /
  `-Root` host artifact check (new exit 7), `--log` flags the Java class and `/dms/services/ServerUI` requests, IOC
  label cites BleepingComputer, verdict text updated. The news outlets cited in 1.2.0 other than BleepingComputer are
  no longer named or linked (sourcing policy). Fixtures: `access_4ever.log`, three `root_*` trees; in
  `access_clean.log` one UI line moved to the v2 path so the clean log stays clean under the new ServerUI rule.
  Tests: static gates moved to `tests/gates.sh`, new 1.3.0 gates, `tests/negative_gates.sh` added. Built in a new
  folder; the 1.2.0 and 1.1.0 folders are unchanged.

* 1.2.0 (12 Nov 2026): security researchers claim 4EverAble2Shell and Agent2Shell work against 2026.4 HF2 (build
  2026.4.1.26); N-able is investigating (Uptime incident 202609, 07:00 GMT) and has no fix. New README section with
  facts, N-able's advice (credited), OUR ADVICE (labelled), corrections and unverified items. Checkers: builds at or
  above 2026.4.1.26 now report `PATCHED (HF2 CVEs); NEW UNPATCHED ISSUES (4EverAble2Shell/Agent2Shell): ...` with
  exit 3 (Legacy API recorded disabled), 6 (not recorded, new) or 1 (enabled); operator supplied Legacy API state
  (`--legacy-api`, `-LegacyApi`, `legacy_api` column); `--log` reports the news-sourced IP, `--extra-ip` IPs and
  Legacy SOAP EI 2xx requests. KQL: hunts Q7, Q7b, Q7c, Q7d, Q7e, Q7f; Q1 to Q6e unchanged. Sigma: four new rules.
  Tests, fixtures and `run_all.sh` gates extended; `tests/kql_parse.ps1` and `tests/sigma_convert.sh` added. Built in
  a new folder; the 1.1.0 folder is unchanged. Sources rechecked 12 Nov 2026 13:24 to 13:30 GMT.
* 1.1.0 (11 Nov 2026): N-able released N-central 2026.4 HF2 (build 2026.4.1.26) and seven CVEs. Checkers now report
  `PATCHED (HF2 CVEs)` (exit 3) at 2026.4.1.26 or later and `VULNERABLE` (exit 1) below it; missing or partial
  builds keep the exposure based verdicts, renamed from `EXPOSED / NO PATCH AVAILABLE` to `EXPOSED / BUILD NOT
  CONFIRMED`. README status, advice, CVE table and gaps rewritten from N-able's release notes, Uptime page and
  CVE records. KQL header, Q1b and Q6 comments updated; the 15 hunt IDs and query logic are unchanged. New fixtures
  `inv_hf2.csv` and `inv_patched_only.csv`; other inventory fixtures adjusted; tests and guards updated.
* 1.0.0 (9 Nov 2026): first release, before any fix or CVE existed.