Attackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability called "4EverAble2Shell" to compromise servers and install cryptocurrency miners, researchers say. At least 21 systems have been affected, including 19 that were running N-able's latest security update. The attacks began after security researcher Sean Bales released proof-of-concept exploits for two new zero-days, 4EverAble2Shell and Agent2Shell, on November 12.
N-central is a remote monitoring and management platform that managed service providers and IT teams use to monitor, manage and secure customer devices and networks remotely. According to Bales, 4EverAble2Shell lets unauthenticated attackers run commands as root on vulnerable N-central servers, though exploitation requires the platform's Legacy API functionality to be enabled. The chain combines an Apache Axis vulnerability tracked as CVE-2026-90436 with a separate N-central privilege escalation weakness to reach root access. The second exploit, Agent2Shell, targets N-central's agent functionality and is claimed to allow command execution with SYSTEM privileges on Windows devices.
Bales said both exploits were tested against N-central Appliance 2026.4.1.26 HF2, the security update N-able released on November 10. The new disclosures came two days after that emergency update, which addressed critical N-central zero-day flaws Bales had publicly disclosed earlier in the week. Before the latest release, N-able took its hosted N-central environments offline and urged on-premises customers to shut down their servers after Bales published more than 30 alleged zero-day vulnerabilities. Bales has criticized N-able's handling of the disclosures and its slow patching of responsibly reported flaws, and said the company has not fixed two unrelated remote code execution bugs in a different N-able product that he reported in July.
In a November 12 security advisory, N-able said it is adding protections while it develops further fixes, including restricting certain N-central features and integrations. The company said the measures may affect some functionality but that additional precautions are the right action to protect partners and their customers. N-able said it disabled the Intune integration as a precaution and is urging on-premises customers to keep Legacy API access disabled, which is already the default. The protections have been applied to hosted environments, and customers are advised to continue upgrading Agents and Probes under the earlier Hotfix 2 guidance. N-able said in the advisory that it had seen no signs of compromise from the new flaws.
Cybersecurity company Previdian told BleepingComputer that probing for 4EverAble2Shell started on November 12, shortly after the proof-of-concept went public. Previdian first saw suspicious requests against its N-central honeypot at about 08:30 UTC using the same Java class referenced in the released exploit, and later confirmed attackers were running the full exploit chain against the honeypot. According to Previdian, the attack first uses Apache Axis CVE-2026-90436 to execute commands as the "nable" service account, then exploits the privilege escalation flaw to obtain root. That stage abuses N-central's privileged setLDFileOwner helper and a symbolic link to make a normally root-owned script writable; the attacker then modifies the script and invokes N-central's serverControl functionality to run commands as root, attempting to restore the modified files afterward.
More cybersecurity news from TechManNews.
