Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2
N-able has confirmed hackers are exploiting newly disclosed vulnerabilities in its N-central management platform, with 21 servers compromised and cryptocurrency miners deployed.
N-able on Thursday announced it's implementing additional security measures following the public disclosure of two critical vulnerabilities affecting its N-central management platform. The company is restricting certain features and integrations as it works to address the flaws, which have already been exploited to compromise 21 servers across multiple countries.
The vulnerabilities, tracked as 4EverAble2Shell and Agent2Shell, were disclosed by independent security researcher Sean Bales. These flaws affect the latest version of N-central and can allow attackers to execute arbitrary code as root and gain SYSTEM-level access to Windows systems under specific conditions.
Active Exploitation Underway
Multiple threat intelligence reports confirm that 4EverAble2Shell has moved beyond initial probing to active exploitation. Threat actors are leveraging the vulnerability to deploy cryptocurrency miners on vulnerable servers. The attack chain combines a critical Apache Axis vulnerability (CVE-2026-90436, CVSS score: 9.8) with an N-central privilege escalation weakness.
An unauthenticated exploit chain in N-able N-central, disclosed as 4EverAble2Shell, is reported to allow remote attackers to execute arbitrary operating-system commands with root privileges.
Miner Deployment Details
Cybersecurity company Huntback revealed that threat actors are using the IP address 157.20.241[.]16 to weaponize the 4EverAble2Shell flaw. They deploy an XMRig Monero cryptocurrency miner on compromised N-central servers via a shell script that downloads from the attacker-controlled server. The miner is designed to use only half of available CPU cores, likely to avoid detection.
The compromised servers are concentrated across the U.S., South Africa, Canada, the U.K., Germany, France, and Sweden. 19 of the 21 infected servers were already running Hotfix 2, indicating that the patch alone is insufficient to protect against these vulnerabilities.
N-able's Response
In response to the threats, N-able has implemented several protective measures for its hosted environments. The Legacy API is now turned off by default, and Intune integration has been disabled while additional protections are implemented. The company is also urging customers to upgrade Agents and Probes to version 2026.4 HF1 and above.
For on-premises customers, N-able recommends upgrading Agents and Probes and ensuring Legacy API access is disabled if it was previously enabled. The company's security teams are actively assessing the new disclosures and developing additional remediation while working to safely restore affected functionality.
Related
