N-able N-central Zero-Day Exploited Within Hours; 21 Servers Mining Monero

By Daniel Okafor

Attackers compromised at least 21 production N-able N-central servers within hours of a public proof-of-concept release on November 12. Nineteen of those servers ran the vendor's latest security update, Hotfix 2, issued just two days earlier. That single detail undermines the usual "patch and move on" guidance. The payload was an XMRig Monero cryptocurrency miner.

What was disclosed?

Security researcher Sean Bales released two new zero-day exploits: 4EverAble2Shell and Agent2Shell. He tested both against N-central Appliance 2026.4.1.26 HF2, the update N-able shipped on November 10. N-central is a remote monitoring and management platform used by managed service providers to secure customer devices and networks.

4EverAble2Shell lets unauthenticated attackers run commands as root on vulnerable N-central servers. It chains an Apache Axis flaw, tracked as CVE-2026-90436, with a separate N-central privilege escalation weakness. One condition applies: exploitation requires the Legacy API functionality to be enabled. Agent2Shell targets the agent component and grants SYSTEM-level privileges on Windows devices.

The disclosures came two days after N-able pushed emergency updates for earlier zero-days and took its hosted environments offline. Bales had published more than 30 alleged zero-day vulnerabilities that week. He also claims N-able never patched two unrelated RCE flaws in a different product, disclosed responsibly in July. That is four months of silence on reported flaws.

"It's much much easier for me to just release the research I have and the vendor can decide what they want to do with it, what they do and don't want to fix, etc. :)," Bales told BleepingComputer.

How fast did exploitation begin?

Faster than most incident response cycles. Previdian observed probing against its N-central honeypot at roughly 08:30 UTC on November 12, shortly after the PoC went public. The requests used the same Java class referenced in the released exploit.

Huntback saw the same attacker IP, 157.20.241[.]16, probing its honeypots at the same time. Full exploit chain attempts began at 09:16 UTC. That is under an hour from disclosure to weaponization attempts.

The chain works in stages. First, CVE-2026-90436 executes commands as the 'nable' service account. Then the privilege escalation abuses N-central's privileged setLDFileOwner helper and a symbolic link to make a root-owned script writable. The attacker modifies that script and invokes serverControl to run commands as root, restoring files afterward to cover tracks.

Previdian tracks the escalation flaw as VULN-2026-0009 and added it to its own Known Exploited Vulnerabilities catalog. The payload pulled a shell script from the attacker-controlled IP and exfiltrated diagnostics to the same address.

How widespread is the damage?

Huntback traced victims through mining pool statistics. Infected systems carried identifiers starting with "nc_" followed by the server IP. At 12:50 UTC on November 12, researchers counted 21 active miners, all submitting shares within the previous five minutes.

All 21 hosts ran N-central installations. Nineteen ran version 2026.4.1.26, the Hotfix 2 release from November 10. Victims span the United States, Canada, South Africa, the United Kingdom, Germany, France, and Sweden.

The miner used roughly half of available CPU cores, likely to evade detection. Cryptojacking is the observed goal, but the caveat writes itself: root access to MSP management infrastructure is a staging point for attacks on every managed customer environment downstream.

What has N-able done?

In a November 12 advisory, N-able said it is restricting certain features and integrations while developing fixes. "These measures may affect some functionality, but we believe taking additional precautions while remediation is completed is the right action to protect our partners and their customers," the company said.

The company disabled the Intune integration as a precaution. Hosted environments already have the protections. On-premises customers must verify Legacy API access is disabled, which is the default, and continue upgrading Agents and Probes under the Hotfix 2 guidance.

N-able's advisory stated it had seen no signs of compromise using the new flaws. Independent researchers confirmed successful exploitation against production servers anyway. The vendor's visibility, in short, lags the field.

What should defenders check?

Huntback and Previdian recommend hunting for:

• Suspicious requests to /dms/services/ServerUI, especially those referencing jline.internal.TerminalLineSettings
• Unexpected xvd.service systemd services
• Cryptocurrency mining processes
• Files created under /tmp/.xvd or /var/tmp/.xvd

Any organization detecting these indicators should assume full server compromise. The chain grants root. Treat it accordingly.