N-able customers are facing active exploitation of a newly disclosed N-central zero-day vulnerability called 4EverAble2Shell, with attackers deploying cryptocurrency miners on compromised servers within hours of the public proof-of-concept release.
Security researcher Sean Bales published exploits for both 4EverAble2Shell and Agent2Shell on November 12, targeting N-central Appliance 2026.4.1.26 HF2. The first exploit chains an Apache Axis vulnerability (CVE-2026-90436) with an N-central privilege escalation flaw to achieve root access on appliances when the Legacy API is enabled. The second targets the agent component to obtain SYSTEM privileges on Windows endpoints.
N-central is a remote monitoring and management platform widely used by managed service providers. Bales released the PoCs just two days after N-able issued emergency patches for earlier zero-days he had disclosed. The researcher criticized the vendor's slow response to previously reported issues and stated that public release allows the company to decide which flaws to address.
N-able reacted by disabling the Intune integration and restricting other features while developing fixes. The company advised on-premises customers to ensure Legacy API access remains disabled, its default setting, and to continue applying the previous Hotfix 2 guidance for Agents and Probes.
Cybersecurity firms Previdian and Huntback confirmed exploitation. Previdian observed probing at 08:30 UTC followed by full exploit attempts that abused the privileged setLDFileOwner helper and symbolic links. Huntback reported 21 compromised servers, 19 running the latest patched version, all installing an XMRig miner via a script downloaded from 157.20.241[.]16. The miners were configured with identifiers beginning with nc_ followed by the server IP.
Organizations are urged to check for suspicious requests to /dms/services/ServerUI referencing jline.internal.TerminalLineSettings, unexpected xvd.service systemd units, and files under /tmp/.xvd or /var/tmp/.xvd. Because the exploit grants full root access, any detected compromise should be treated as a complete server breach.
