Attackers exploited a newly disclosed N-able N-central zero-day within hours of its public release, compromising at least 21 production servers and planting cryptocurrency miners on them, security researchers have reported.

The flaw, dubbed 4EverAble2Shell, was one of two new exploits published this week by independent security researcher Sean Bales. It allows an unauthenticated attacker to execute commands as root on a vulnerable N-central server, provided the platform's Legacy API feature is switched on. The second exploit, Agent2Shell, targets N-central's agent software and is claimed to allow commands to run with SYSTEM privileges on managed Windows machines.

Exploitation began within hours

Cybersecurity company Previdian said attackers began probing for the flaw on 12 November, shortly after the proof-of-concept code was made public. Suspicious requests reached its N-central honeypot at about 08:30 UTC, using the same Java class named in the published exploit, and attempts to run the full attack chain followed from about 09:16 UTC.

Separate research by Huntback found 21 production N-central servers compromised using the same exploit chain. By 12:50 UTC on 12 November, all 21 were running miners that had submitted work to a mining pool within the previous five minutes. Nineteen of the compromised servers were running version 2026.4.1.26, the latest emergency hotfix N-able released on 10 November. The affected servers were spread across the United States, Canada, South Africa, the United Kingdom, Germany, France and Sweden.

How the attack chain works

The attack starts with an Apache Axis vulnerability tracked as CVE-2026-90436, which carries a CVSS score of 9.8, to run commands as the nable service account. A second stage then abuses a privilege escalation weakness in N-central itself, using a privileged file-owner helper and a symbolic link to make a normally root-owned script writable, before invoking the server's control functions to run commands as root.

The payload observed by researchers downloads a shell script from an attacker-controlled server and installs XMRig, a Monero cryptocurrency miner, configured to use about half of the available processor cores, a setting likely chosen to make the mining harder to notice. Compromised systems were identified through mining pool records, where infected machines carried identifiers beginning with nc_ followed by the server's IP address.

N-able responds with restrictions

In a security advisory on 12 November, N-able said it was restricting certain N-central features and integrations while it works on further fixes, and it has disabled the Intune integration as a precaution. The company urged on-premises customers to make sure Legacy API access is switched off, noting that it is already off by default, and said the protections had been applied to hosted environments. N-able also said it had seen no signs of compromise using the new flaws, a position that sits uneasily with the researchers' reports of compromised production servers.

The disclosure is the latest chapter in a difficult week for N-able. Bales first published more than 30 alleged N-central zero-day vulnerabilities earlier in the week, prompting the company to take its hosted environments offline and urge on-premises customers to shut down their servers. The 10 November hotfix addressed the most critical of those flaws, but the new exploits were tested against that very update, meaning fully patched servers remained exposed where Legacy API was enabled.

What administrators should check

Organisations running N-central should confirm Legacy API is disabled, keep agents and probes updated, and look for suspicious requests to the /dms/services/ServerUI path, unexpected xvd.service systemd services, cryptocurrency mining processes and files under /tmp/.xvd or /var/tmp/.xvd. Because the attack grants full root access, any server showing these indicators should be treated as fully compromised. There is no complete fix for the new flaws yet, so disabling Legacy API is the key immediate defence.

Sources: BleepingComputer, The Hacker News