The Hacker Newsinfo@thehackernews.com (The Hacker News)
Attackers exploit N-able N-central flaws to mine cryptocurrency
Part of the CVE-2026-90436 story · since 12 Nov
- Thu 12 Nov, 13:30 UTC. The Hacker News, first report. Researcher discloses new N-central flaws enabling root access.
- Fri 13 Nov, 06:30 UTC. The Hacker News. Attackers exploit N-able N-central flaws to mine cryptocurrency. This article, 2nd of 4.
- Fri 13 Nov, 08:00 UTC. SecurityWeek, its first report on the story. N-central Zero-Day Exploited Within Hours of PoC Release.
- Fri 13 Nov, 13:00 UTC. SOCRadar, its first report on the story. Attackers exploit N-able N-central flaw to install Monero miners.
N-able disclosed on 13 November 2026 that attackers are actively exploiting a new set of flaws in N-central, tracked as 4EverAble2Shell and Agent2Shell, to compromise devices running the latest N-central. Independent security firm Previdian attributes an unauthenticated exploit chain in N-able N-central—disclosed as 4EverAble2Shell—that enables remote command execution with root privileges via unsafe class instantiation during SOAP fault processing in the bundled Apache Axis component.
Previdian (VULN-2026-0009) notes that a crafted request can trigger processing of a malicious input by a JLine class, resulting in commands executed as the nable service account. Threat reports show 4EverAble2Shell has moved from probing to active exploitation, with attackers using it to deploy cryptocurrency miners on vulnerable servers.
The exploit chain has been linked to CVE-2026-90436 (Apache Axis) and an N-central privilege-escalation weakness, giving attackers root access on Windows under specific conditions, Huntback corroborates that the same IP is weaponising the flaw to drop an XMRig Monero miner to 21 N-central servers.
In response, N-able said it is restricting features and integrations, with actions implemented in Hosted environments including turning off Legacy API by default and disabling Intune integration while protections are validated. Hosted customers are advised to upgrade Agents and Probes on N-central 2026.4 HF1 and above, since 2026.4 HF1 updates change how the Agent and Probe communicate; N-able emphasised that upgrading is essential to ensure devices remain patched and connected.
On‑premises customers are urged to upgrade Agents and Probes and to ensure Legacy API access is disabled if it was previously enabled. The company stated its teams are assessing disclosures and developing remediation while restoring functionality, with protecting partners and customers remaining a priority. Huntback reported the infections span the United States, South Africa, Canada, the United Kingdom, Germany, France, and Sweden, noting that 19 of the 21 victims were already on Hotfix 2.
How the story developed
4 articles from 3 outlets since 12 Nov. Still developing; the latest report was 4 hours ago. This was the 2nd report, 17 hours after the first.
- Thu 12 Nov, 13:30 UTC. The Hacker News, first report. Researcher discloses new N-central flaws enabling root access.
- Fri 13 Nov, 06:30 UTC. The Hacker News. Attackers exploit N-able N-central flaws to mine cryptocurrency. This article, 2nd of 4.
- Fri 13 Nov, 08:00 UTC. SecurityWeek, its first report on the story. N-central Zero-Day Exploited Within Hours of PoC Release.
- Fri 13 Nov, 13:00 UTC. SOCRadar, its first report on the story. Attackers exploit N-able N-central flaw to install Monero miners.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 4 articles as a listHide the list
- Thu 12 NovDay 01
- Researcher discloses new N-central flaws enabling root access13:30 · The Hacker News · First report
- Fri 13 NovDay 13
- Attackers exploit N-able N-central flaws to mine cryptocurrency06:30 · The Hacker News · This article, 2nd of 4
- N-central Zero-Day Exploited Within Hours of PoC Release08:00 · SecurityWeek
- Attackers exploit N-able N-central flaw to install Monero miners13:00 · SOCRadar