New N-able "4EverAble2Shell" zero-day exploited hours after PoC released - BleepingComputer
Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed "4EverAble2Shell" to compromise servers and deploy cryptocurrency miners, with researchers reporting at least 21 affected systems.
The attacks follow security researcher Sean Bales' release of two new zero-day exploits today, dubbed 4EverAble2Shell and Agent2Shell, which he says allow attackers to gain root-level access to N-central appliances and SYSTEM-level access to Windows systems.
N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) and IT teams to monitor, manage, and secure customer devices and networks remotely.
The new vulnerabilities were disclosed on November 12, just two days after N-able released emergency security updates to address critical N-central zero-day vulnerabilities that Bales had publicly disclosed earlier this week.
Exploit Details
Bales published proof-of-concept exploits for both vulnerabilities, tested against N-central Appliance 2026.4.1.26 HF2, the security update N-able released on November 10.
The 4EverAble2Shell exploit allows unauthenticated attackers to execute commands as root on vulnerable N-central servers, requiring the platform's Legacy API functionality to be enabled.
The attack combines an Apache Axis vulnerability (CVE-2026-90436) with a separate N-central privilege escalation weakness to gain root-level access.
The second exploit, Agent2Shell, targets N-central's agent functionality and allows attackers to execute commands with SYSTEM privileges on Windows devices.
Active Exploitation
Cybersecurity companies report that attackers began exploiting the vulnerability within hours of the proof-of-concept release. Previdian observed suspicious requests targeting N-central systems at approximately 08:30 UTC on November 12.
Huntback reports that attackers have successfully compromised at least 21 production N-central servers using Bales' exploit chain, downloading shell scripts that installed XMRig Monero cryptocurrency miners configured to use about half of available CPU cores.
It's much much easier for me to just release the research I have and the vendor can decide what they want to do with it, what they do and don't want to fix, etc. :)
N-able Response
In a November 12 security advisory, N-able said it was implementing additional protections, including restricting certain N-central features and integrations while it develops further fixes.
The company has disabled the Intune integration as a precaution and urges on-premises customers to ensure Legacy API access is disabled, which is already the default. Protections have been applied to hosted environments, but customers should continue upgrading Agents and Probes.
Organizations running N-central should investigate suspicious requests to /dms/services/ServerUI, check for unexpected systemd services, and treat any compromise as a full server breach due to the root access granted by the vulnerability.
Related
