N-able Zero-Day Chain Goes From Proof-of-Concept to 21 Hacked Servers in Hours

A zero-day exploit chain dubbed "4EverAble2Shell," targeting N-able's N-central remote monitoring and management platform, moved from public proof-of-concept to active, in-the-wild exploitation within hours on November 12, according to security researchers Previdian and Huntback. The chain combines a flaw in an Apache Axis component — tracked as CVE-2026-90436 — with a separate N-central privilege-escalation weakness, tracked by Previdian as VULN-2026-0009, to grant unauthenticated attackers root access on servers where N-central's Legacy API is enabled.

Huntback reported attackers began probing honeypots around 08:30 UTC and launched full exploit-chain attempts by 09:16 UTC; by 12:50 UTC, the firm counted 21 actively mining servers among the compromised hosts, spanning the United States, Canada, South Africa, the United Kingdom, Germany, France, and Sweden. The observed attacks deployed the XMRig Monero cryptominer, pulling payloads from a server at 157.20.241[.]16. A related exploit called "Agent2Shell," targeting N-central's agent functionality, is claimed to allow attackers to run commands with SYSTEM-level privileges on managed Windows endpoints — a detail that matters because N-central is RMM software: it exists specifically to let managed service providers reach into and control their customers' infrastructure, which is exactly what makes a compromise of the platform itself so disproportionately damaging.

The proof-of-concept exploits came from security researcher Sean Bales, who in early November published more than 30 alleged N-central zero-days and has been openly critical of N-able's disclosure process, saying the company left two unrelated remote-code-execution bugs he reported in a different product unpatched since July without paying a bounty. That earlier disclosure forced N-able to take its hosted N-central environments offline worldwide; the company shipped Hotfix 2 (version 2026.4.1.26 HF2) on November 10. Despite the patch, Huntback found 19 of the 21 compromised servers it identified were already running that same hotfixed version, indicating HF2 did not fully close the hole.

On November 12, N-able added further mitigations: disabling its Intune integration, restricting certain platform features, and urging customers to confirm the Legacy API — disabled by default — remains off. The company says additional fixes are in development but has not given a timeline. N-able's own advisory initially reported no signs of compromise before outside researchers demonstrated otherwise, a sequence that underscores a recurring problem in RMM security: because these platforms are built for broad administrative reach by design, a vendor's own telemetry can miss exploitation that a customer's own monitoring catches first. Organizations running N-central should check for unexpected requests to /dms/services/ServerUI referencing jline.internal.TerminalLineSettings, an unfamiliar xvd.service, unexplained mining processes, and files under /tmp/.xvd or /var/tmp/.xvd.