New N-able exploits hit patched N-central servers, miners deployed

N-able is investigating a second wave of N-central disclosures that reportedly defeat the hotfix shipped two days ago. Researcher Sean Bales published two new proof-of-concept toolkits — 4EverAble2Shell (unauthenticated RCE as root on the N-central server) and Agent2Shell (more than ten zero-days chained to run commands as NT AUTHORITY\SYSTEM on managed Windows agents, given a known appliance ID). Both work against N-central 2026.4.1.26 (2026.4 Hotfix 2), the build N-able released on November 10 to close the first Able2Shell set. Probing started within hours of the release. If you self-host N-central with the Legacy API exposed, treat this as a live incident.

What's affected

The server-side chain requires a non-default configuration: the Legacy API turned on and reachable from the internet. N-able says the Legacy API is off by default and "not recommended." According to The Hacker News, the observed chain begins with CVE-2026-90436, an Apache Axis flaw (CVSS 9.8) patched upstream on November 6, used for the initial unauthenticated command execution, then escalates to root via 4EverAble2Shell. The privilege-escalation issue is tracked by threat-intel firm Previdian as VULN-2026-0009; no CVE has been assigned to it at the time of writing.

Exploitation status

Sources differ on whether exploitation has succeeded. Previdian founder Ryan Dewhurst told The Hacker News his honeypot logged targeted probing from 157.20.241[.]16 within hours of the PoC — which he calls the first documented exploitation attempt against CVE-2026-90436 — but reports "no evidence of successful exploitation" so far. BleepingComputer, citing Huntback, reports at least 21 compromised production N-central servers — 19 of them running the patched 2026.4.1.26 — with attackers deploying the XMRig Monero miner tuned to roughly half the CPU cores to stay quiet. Affected servers were seen in the US, Canada, South Africa, the UK, Germany, France, and Sweden. watchTowr says it is also seeing probes against Legacy API-enabled builds. N-able's November 12 advisory says it has seen "no signs of compromise" from the new flaws and is restricting certain features — it disabled the Intune integration as a precaution.

Action checklist

1. Disable the Legacy API now and confirm it is not reachable from the internet. This is the single condition the server chain depends on.
2. Hunt, don't trust the patch. 2026.4.1.26 does not block these exploits. Review requests to /dms/services/ServerUI, especially any referencing jline.internal.TerminalLineSettings.
3. Check for the miner. Look for an unexpected xvd.service systemd unit, cryptomining processes, and files in /tmp/.xvd or /var/tmp/.xvd. Block/alert on 157.20.241[.]16.
4. Assume root compromise if any indicator is present, and assume downstream exposure: N-central's agents reach every managed endpoint, so rotate credentials and review agent-pushed actions.
5. Follow N-able's status channel for the pending fix and any further feature restrictions.

Context

This is the direct sequel to the Able2Shell disclosure earlier this week, and it lands the same way: an RMM platform, an uncoordinated multi-flaw dump with working PoC, and a patch that turns out not to be the end of it. N-central was exploited in the wild in September (CVE-2026-86218) and sat behind an August authentication-bypass chain added to CISA's KEV catalog. Platforms that reach every managed estate are exactly what ransomware crews and cryptominers race for — and here the race restarted the moment the first hotfix shipped. Pull the Legacy API off the internet and work the hunt list before you trust the next build.