N-able N-central Hit by Active 4EverAble2Shell Exploitation Chain Delivering XMRig Miners
N-able disclosed additional restrictions on N-central features after independent researcher Sean Bales published details on two exploit chains, 4EverAble2Shell and Agent2Shell, affecting the latest product versions. The 4EverAble2Shell chain combines CVE-2026-90436 in the bundled Apache Axis component with an N-central privilege-escalation flaw, allowing unauthenticated remote code execution as root on Linux and SYSTEM on Windows. Threat actors have already moved from scanning to deploying cryptocurrency miners, with Huntback confirming XMRig installations on 21 servers across seven countries. Nineteen of the compromised servers were already running Hotfix 2, indicating that the patch alone does not fully mitigate the risk. N-able has disabled the Legacy API by default in hosted environments, turned off Intune integration, and instructed both hosted and on-premises customers to upgrade Agents and Probes on version 2026.4 HF1 or later while ensuring Legacy API access remains disabled. The company continues to assess the disclosures and develop further remediation steps.
The Hacker NewsNov 13, 2026Translated from English