Threat actors began exploiting a new zero-day in N-able N-central within hours of a public proof-of-concept release, researchers and incident responders said. The flaw, dubbed 4EverAble2Shell, can allow unauthenticated attackers to achieve remote code execution (RCE) and gain root privileges on N-central servers.
4EverAble2Shell chains an exploit for a recent Apache Axis vulnerability (CVE-2026-90436, CVSS score: 9.8) with an exploit for an unspecified N-central security hole present when Legacy API is enabled, security researcher Sean Bales said. The exploit chain uses the Axis bug to obtain RCE, then attempts privilege escalation to root and to run a shell script.
Bales published the 4EverAble2Shell proof-of-concept on GitHub on November 12, two days after N-able issued fixes for other previously disclosed flaws. He also published PoC code for Agent2Shell on November 12, a set of roughly a dozen zero-day flaws that could let attackers run commands on managed Windows agents with System privileges.
Exploitation observed within hours
Early-warning intelligence platforms and security firms reported active exploitation within hours of the PoC going public. Previdian (formerly KEVIntel) reported usage of the PoC in attacks, and WatchTowr warned that probes for “4EverAble2Shell” were already being observed against builds with the Legacy API enabled.
Lupovis and Huntback observed successful compromises of N-central servers roughly five hours after the PoC publication. Attackers deployed an XMRig miner with systemd or cron persistence; Lupovis said each victim’s miner was named after its IP address and that the attacker wallet showed 21 rigs tied to compromised N-central servers in the US (9), South Africa (4), Canada (4), as well as the UK, Germany, France and Sweden. “Our decoys never execute anything, so none of the listed rigs are ours. Every one is a real server that ran the chain to root,” Lupovis told SecurityWeek.
In a technical write-up, Huntback notes that 19 of the victims had applied the latest patches from N-able. “The miner is the only payload we have seen, but the escalation hands the operator root on a host that manages your customers’ endpoints. Treat a hit as a full compromise, not a cleanup job. Applying Hotfix 2 is not enough on its own,” Huntaback says.
N-able response and mitigations
N-able reacted immediately by restricting certain N-central features and integrations, including Legacy API and Intune integration. On November 13 the company said: “Through our ongoing investigation today, we have identified additional indicators of compromise (IoCs) and are working closely with those specific customers to assess and mitigate any potential risks.”
Bales said the 4EverAble2Shell chain works against N-central servers that had been updated that week to 2026.4 HF2 (build number 2026.4.1.26), which contains fixes for previously released Able2Shell zero-days. Security teams and affected customers have been urged to treat any successful exploitation as a full compromise and to follow vendor guidance and incident response procedures.
