N-able N-central '4EverAble2Shell' Zero-Day Exploited for Cryptojacking Hours After Public PoC Release
Hackers began actively exploiting the newly disclosed N-able N-central zero-day vulnerability dubbed 4EverAble2Shell within hours of security researcher Sean Bales publishing proof-of-concept code. The flaw, combined with an Apache Axis issue tracked as CVE-2026-90436, grants unauthenticated root access when the Legacy API is enabled. At least 21 production servers were compromised, including 19 running the latest Hotfix 2 released just two days earlier. Attackers used the chain to deploy XMRig Monero miners configured to use roughly half the available CPU cores. N-able responded by disabling certain integrations and urging customers to verify Legacy API settings remain disabled. Researchers from Previdian and Huntback observed the attacks starting at 08:30 UTC on November 12 and confirmed the full exploit chain matched Bales' public GitHub release.
BleepingComputerNov 12, 2026Translated from English