N-able is investigating new exploits for its N-central remote monitoring and management platform after Huntback linked an attack campaign to 21 production servers that were running Monero miners. The security firm said 19 of the affected servers were already running N-central 2026.4.1.26, the Hotfix 2 release issued on November 10. N-central is used by managed service providers and IT teams to administer customer devices and networks, making a compromised server a potential route into the environments it manages.
Researcher Sean Bales published two new proof-of-concept exploits, 4EverAble2Shell and Agent2Shell, on November 12. Huntback’s technical analysis says 4EverAble2Shell uses Apache Axis CVE-2026-90436 to run commands as the N-central service account, then abuses a separate N-central privilege-escalation weakness to gain root access and install an XMRig Monero miner. The Apache advisory says CVE-2026-90436 affects Axis 1.x through 1.4, an end-of-life branch. Huntback observed a first probe against its decoys at 08:30 UTC, followed by a weaponized request at 09:16 UTC, and later identified 21 active miner rigs on a public pool, all linked to N-central login pages.
BleepingComputer reported that N-able’s November 12 advisory said it had seen no signs of compromise using the new flaws. In a separate November 11 update, N-able said it had seen no indications of compromise within its hosted N-central servers and could not determine whether individual customer environments had been compromised without assessing them. The company said the new server-side issue requires the Legacy API to be enabled and exposed to the public internet, a non-default configuration it does not recommend. N-able said additional protections had been applied to hosted environments and urged on-premises customers to ensure Legacy API access is disabled. Huntback did not report whether the Legacy API was enabled on the 21 servers it identified.
Previdian separately recorded two attempts against the new chain on November 12 and tracks the N-central privilege-escalation issue as VULN-2026-0009, a researcher-assigned identifier rather than a CVE. The firm says its sensor telemetry confirms attempts but does not establish whether they succeeded. Its vulnerability report says the proof of concept was tested against build 2026.4.1.26, but the full affected-version range and a fixed build have not been confirmed. The development follows N-able’s recent Hotfix 2 release and its earlier decision to take hosted N-central offline after the Able2Shell disclosure.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
