Hackers Exploit New N-central Zero-Day Hours After PoC Publication
Threat actors began exploiting a new zero-day vulnerability in N-able N-central just hours after security researcher Sean Bales publicly released proof-of-concept code.
The security flaw, dubbed 4EverAble2Shell, chains an exploit for Apache Axis vulnerability CVE-2026-90436 (CVSS score: 9.8) with an unspecified hole in N-central deployments that have Legacy API enabled. This combination allows attackers to achieve remote code execution and elevate privileges to root level.
Immediate Exploitation
According to threat intelligence platform Previdian, attackers began using the PoC within hours of its publication on November 12. Lupovis and Huntback observed successful compromises approximately 5 hours later, with attackers deploying XMRig miners on compromised systems.
Each victim's miner is named after its IP address
N-able's Response
N-able reacted swiftly by restricting certain N-central features, including Legacy API and Intune integration. The company stated they were working with affected customers to assess and mitigate potential risks.
Notably, 19 of the compromised servers had applied the latest patches from N-able, indicating that Hotfix 2 alone is insufficient protection against this exploit chain.
Related
