Hackers began exploiting a new zero-day vulnerability in N-able N-central within hours of a proof-of-concept exploit becoming public. The flaw, called 4EverAble2Shell, can let unauthenticated attackers execute code with root privileges on vulnerable N-central servers, including systems running the latest available patches.
The vulnerability was published on GitHub by security researcher Sean Bales, two days after N-able released fixes for several other flaws he had disclosed. 4EverAble2Shell chains an exploit for a recent Apache Axis vulnerability, CVE-2026-90436, with an unspecified flaw affecting N-central deployments that have the Legacy API enabled. The Apache Axis issue has a CVSS score of 9.8, reflecting its critical severity.
Modus operandi
The attack chain first exploits the Apache Axis bug to achieve remote code execution. It then attempts to elevate its privileges to root and run a shell script. Researchers said the chain works against N-central servers updated to 2026.4 HF2, build 2026.4.1.26, which had already received fixes for earlier Able2Shell zero-days. This means applying the latest hotfix alone does not fully eliminate the risk.
N-able responded by restricting several N-central features and integrations, including the Legacy API and Intune integration. The company said it had identified additional indicators of compromise and was working with affected customers to assess and mitigate potential risks. On November 12, Bales also published proof-of-concept code for Agent2Shell, a set of roughly a dozen zero-day flaws that could allow attackers to execute commands on managed Windows agents with System privileges.
Threat intelligence firm Previdian reported that attackers began using the 4EverAble2Shell proof of concept within hours of publication. WatchTowr also observed probes targeting N-central systems with the Legacy API enabled. Lupovis and Huntback found evidence of successful compromises about five hours after the exploit was released, with attackers deploying an XMRig cryptocurrency miner and using systemd or cron for persistence.
The attackers named each miner after the victim’s IP address. Lupovis said the attacker’s wallet showed 21 rigs connected to compromised N-central servers in the United States, South Africa, Canada, the United Kingdom, Germany, France, and Sweden. The researchers said their decoy systems did not execute the exploit, confirming that the listed systems were real victims.
Huntback found that 19 victims had already applied N-able’s latest patches. The firm warned that the miner may be the only observed payload, but the privilege escalation gives attackers root access to a server that manages customer endpoints. Security teams should therefore treat any successful exploitation as a full compromise rather than a minor cleanup task.
Organisations using N-central should immediately disable the Legacy API where possible, apply vendor guidance, review logs for exploitation indicators, and rotate credentials connected to affected systems. They should also inspect AWS, Azure, and other connected environments for suspicious access, because root-level compromise of an RMM server can expose downstream customer networks.