4EverAble2Shell: N-able N-central root exploit hits 21 servers, 19 on Hotfix 2, no fix yet

Attackers are breaking into on-premises N-able N-central servers through an exploit chain called 4EverAble2Shell, and as of 13 November N-able has not shipped a build that fixes it. Researchers report at least 21 compromised production servers, 19 of which were already running the latest security update, Hotfix 2 (build 2026.4.1.26). The attacks need the server's non-default Legacy API to be switched on, so the fastest protection is to check that setting now.

Key points

• 4EverAble2Shell lets an unauthenticated attacker run commands as root on an on-premises N-central server, but only when the Legacy API is enabled, according to BleepingComputer and SOCRadar.
• Researcher Sean Bales published exploit code on 12 November (BankInfoSecurity dates his release to Wednesday 11 November); attacks followed within hours.
• Huntback counted 21 servers running an XMRig Monero miner, 19 of them on N-central 2026.4 Hotfix 2 (build 2026.4.1.26), so that hotfix does not stop the chain.
• The first stage is CVE-2026-90436, a 9.8-rated flaw in the old Apache Axis 1.x component; the privilege escalation that follows has no CVE yet.
• N-able disabled the Intune integration and tells on-premises customers to confirm the Legacy API is off, while it develops further fixes.

What to do

• Who is affected: on-premises N-central servers with the Legacy API enabled. N-able says the Legacy API is off by default and that its hosted N-central environments have protections applied. The exploit was tested against build 2026.4.1.26 (Hotfix 2), released on 10 November.
• Fix: none yet for this chain. N-able says it is developing further fixes and, per Tuskira's advisory summary, a follow-up hotfix is planned. Still install Hotfix 2 (release notes: N-central 2026.4 HF2) because it addresses the earlier "Able2Shell" flaws, then upgrade Agents first and Probes second, as N-able instructs.
• Workaround: disable the Legacy API on every on-premises server, even those on Hotfix 2. Keep the Intune integration off. SOCRadar adds that putting the web and SOAP endpoints behind a VPN reduces exposure, while an IP allowlist alone is not enough.
• Check whether you were hit: Huntback advises looking for requests to /dms/services/ServerUI that mention jline.internal.TerminalLineSettings, an unexpected xvd.service systemd unit, mining processes, and files under /tmp/.xvd or /var/tmp/.xvd. The observed attackers contacted 157.20.241[.]16 to fetch a shell script.
• If you find a match: treat it as a full server compromise, because the attacker had root. Isolate the server, keep evidence, rebuild from a known good install and rotate every credential stored in N-central, as SOCRadar recommends. Review managed endpoints for new accounts, tasks, scripts and remote sessions since 11 November (8 November for servers not yet on Hotfix 2).

What happened

On Monday 9 November the researcher Sean Bales, who goes by "MSPNightmare", published an exploit chain called Able2Shell against N-central, N-able's remote monitoring and management platform for managed service providers. BankInfoSecurity describes it as more than 30 vulnerabilities leading from anonymous access to root. N-able took its hosted software offline and told self-hosted customers to do the same, then released Hotfix 2 for on-premises servers on 10 November.

Two days later Bales released two more exploits. 4EverAble2Shell targets the server; Agent2Shell is a set of more than ten exploits that run code with SYSTEM privileges on Windows devices managed by N-central agents, according to BankInfoSecurity. BleepingComputer says Bales published both on 12 November, two days after the Hotfix 2 release; BankInfoSecurity puts the date at Wednesday 11 November. We could not reconcile the one-day difference, and it does not change the advice.

Exploitation started the same day. BleepingComputer reports that Previdian saw probing of its N-central honeypot from about 08:30 UTC on 12 November, using the same Java class as the public exploit, and later saw full-chain attempts. Huntback saw the same attacker IP address probe its honeypots at about 08:30 UTC and begin full-chain attempts at 09:16 UTC. SecurityWeek and SOCRadar put the first compromises about five hours after the proof of concept appeared, and name Lupovis alongside Huntback as having seen compromised servers. watchTowr reported probes against builds with the Legacy API enabled, per BankInfoSecurity. Huntress said on the morning of 12 November it had not yet seen exploitation in its partners' environments.

By 12:50 UTC Huntback had found 21 active miners. It identified victims through mining pool statistics, where the workers were named nc_ followed by the server's IP address. The victims are in the US, Canada, South Africa, the UK, Germany, France and Sweden. SecurityWeek's count puts nine in the US, four in South Africa and four in Canada.

Background

N-central is the kind of software that makes a managed service provider's job possible and an attacker's job rewarding: one server holds the credentials and remote-execution rights for every customer environment it manages. That is why an unauthenticated root flaw on the server matters more than the cryptominer that has been seen so far. Huntback and BleepingComputer both note that the observed activity is cryptojacking, but that compromised N-central infrastructure could be used to attack managed customers.

Bales said he published without warning because N-able had not fixed two unrelated remote code execution flaws in a different N-able product that he reported in July, more than five months earlier, according to BankInfoSecurity. BleepingComputer quotes him saying it is "much much easier" for him to release research and let the vendor decide what to fix. N-able chief executive John Pagliuca responded, per BankInfoSecurity, that publishing exploit code before customers can patch gives attackers a head start. Whatever one thinks of the method, the gap between publication and attack was a matter of hours, while BankInfoSecurity cites Rapid7 as putting the average at three days after disclosure.

How it works

According to BleepingComputer and Previdian's write-up as relayed by The Hacker News, the chain has two stages:

1. Axis stage. CVE-2026-90436, a flaw in the end-of-life Apache Axis 1.x library bundled with N-central, allows unsafe class instantiation while the server processes a SOAP fault. It gives the attacker command execution as the low-privileged nable service account. SOCRadar says CISA's score for it is 9.8.
2. Root stage. The attacker abuses a privileged helper, setLDFileOwner, together with a symbolic link to make a root-owned script writable, and so becomes root. This weakness has no CVE; Previdian tracks it as VULN-2026-0009.

The payload fetches a script called jup.sh from 157.20.241[.]16 on port 8080, remounts /tmp as executable and runs it, according to The Hacker News. In the cases Huntback saw, the script installed an XMRig miner set to use about half the CPU cores, which makes it harder to notice, and kept it running with systemd or cron.

Hotfix 2 (2026.4.1.26)19

Other builds2

N-central servers found mining Monero on 12 November, by build (servers)

	servers
Hotfix 2 (2026.4.1.26)	19
Other builds	2

Source: BleepingComputer, citing Huntback

What it means

For MSPs, the lesson is that "fully patched" was not a safe state on 12 November. Nineteen of 21 victims had the latest hotfix, so the exposure came from a feature (the Legacy API) and not from a missing update. Disabling unused interfaces and removing management servers from the open internet are the controls that worked here.

For N-able, the open question is how long customers must run with workarounds. N-able's advisory, as reported by BleepingComputer, said the company had seen no signs of compromise from the new flaws; researchers then reported compromised production servers, and SecurityWeek says that on 13 November N-able said it had found additional indicators of compromise and was working with affected customers.

For defenders more broadly, the attack is a reminder that old bundled components such as Apache Axis 1.x, which is end of life, can sit under a modern product and open the first door.

What we don't know yet

• When a fix arrives. N-able has not published a build that fixes the chain. Sources differ on whether a follow-up hotfix has a date; none of the sources we read gives one.
• A CVE for the root stage. None had been assigned in the sources we read, and CISA's Known Exploited Vulnerabilities list did not include CVE-2026-90436 as of SOCRadar's report.
• The full scale. The 21 servers were found through mining pool statistics, so servers whose attackers did not mine, or that did not use the same payload, would not appear. Whether attackers used the root access for more than mining is unconfirmed.
• Agent2Shell exploitation. SOCRadar says none had been reported.
• Exact publication dates. The 11 versus 12 November difference above.

What to watch next

Watch N-able's status page for the follow-up hotfix and its incident updates (the incident Tuskira lists for the Legacy API guidance is 202613), whether a CVE is assigned to the root stage, and whether CISA adds CVE-2026-90436 to its KEV catalog. If attackers move from miners to ransomware or credential theft, MSP customers' own networks become the target.

Sources

• N-central 2026.4 HF2 release notes, N-able (primary)
• New N-able "4EverAble2Shell" zero-day exploited hours after PoC released, BleepingComputer
• Hackers Exploit New N-central Zero-Day Hours After PoC Publication, SecurityWeek
• Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2, The Hacker News
• 4EverAble2Shell: N-central Zero-Day Exploited, SOCRadar
• Researcher Drops More Zero-Day Exploits for N-Able Software, BankInfoSecurity
• N-able N-central Able2Shell: Legacy API, HF2 exploitation reports and fix, Tuskira