Attackers exploit N-able N-central flaw to install Monero miners

An independent researcher disclosed 4EverAble2Shell, a two‑stage exploitation chain targeting on‑premises N-able N-central servers. The chain allows an unauthenticated attacker to execute commands as root when the server’s Legacy API is enabled and exposed to the internet. Sean Bales published a public proof of concept on 12 November 2026, and attackers quickly used it to drop XMRig Monero miners on at least 21 N-central servers within hours.

The vulnerability is tied to the first stage’s exploitation of CVE-2026-90436, a flaw in the end-of-life Apache Axis 1.x SOAP engine; the second stage is a local privilege escalation within N-central that currently has no CVE assigned. N-able stresses that the server attack requires a non-default configuration and notes that the Legacy API is off by default and should remain disabled.

Evidence gathered by researchers shows the exploitation was observed in the wild on 12 November 2026, with 19 of the 21 compromised servers running N-central build 2026.4.1.26 (Hotfix 2) and the remainder on older releases such as 2025.3.1.9; N-able admits Hotfix 2 does not protect against 4EverAble2Shell, and there is no fixed build for the full chain to date.

A companion set, Agent2Shell, supposedly enables SYSTEM‑level command execution on Windows endpoints managed by N-central, though no exploitation has been reported. Defenders are advised to disable the Legacy API and restrict internet exposure, guard against listed indicators of compromise, and rebuild affected servers from known‑good installations while rotating credentials.