Attackers used the newly disclosed 4EverAble2Shell exploit chain to compromise N-able N-central servers within hours of its November 12, 2026 release, according to researchers cited by SecurityWeek. Huntback identified 21 production servers associated with active Monero cryptocurrency miners, including 19 running Hotfix 2—the emergency security update released just two days earlier. Source Source
Hotfix 2 addresses earlier vulnerabilities, but it doesn’t stop this new chain on its own. Researcher Sean Bales says the server exploit requires N-central’s Legacy API to be enabled. SOCRadar identifies internet-facing, on-premises installations with that feature enabled as exposed. N-able urges on-premises customers to disable the API, which is off by default. Source Source Source
N-central is a remote monitoring and management platform that managed service providers and IT teams use to administer customer computers and networks. A management server is a lousy place for an uninvited side hustle. The concern extends beyond the mining workload: the exploit gives attackers root privileges, the highest level of control on the server. Source
Why Hotfix 2 wasn’t enough
Bales published the new proof-of-concept exploit on November 12, saying it worked against N-central Appliance 2026.4.1.26 HF2. N-able had released that update on November 10 in response to earlier vulnerability disclosures. Source
BleepingComputer describes a two-stage attack: an Apache Axis vulnerability, CVE-2026-90436, first provides command execution under the nable service account. A separate N-central privilege-escalation weakness then raises that access to root. Source
Huntback’s reported victim count came from mining-pool statistics. The attackers assigned miners identifiers beginning with nc_, followed by the server’s IP address. At 12:50 UTC on November 12, Huntback found 21 active miners using that pattern and checked the associated addresses against N-central installations. Nineteen were running Hotfix 2. Source Source
As of SOCRadar’s November 13, 2026 account, N-able had not released a build fixing the new chain. Source
Disable the API—and investigate
N-able has restricted features and integrations while developing further protections, including disabling the Intune integration as a precaution. In a November 13 statement quoted by SecurityWeek, the company said it had identified additional indicators of compromise and was working with specific customers to assess and mitigate potential risks. Source Source
- Disable Legacy API access on on-premises servers. N-able is urging customers to ensure the normally disabled feature stays off. Source
- Continue Agent and Probe upgrades under N-able’s Hotfix 2 guidance. The new attack does not make the earlier updates disposable. Source
- Investigate signs of exploitation. Huntback recommends checking for unexpected
xvd.service services, cryptocurrency-mining processes, and files under /tmp/.xvd or /var/tmp/.xvd. Suspicious requests to /dms/services/ServerUI, especially references to jline.internal.TerminalLineSettings, also warrant investigation. These indicators are leads, not a complete test that can certify a server clean. Source Source
Huntback reported XMRig as the only payload it had seen, but warned that the chain grants root access to a server managing customer devices. “Treat a hit as a full compromise, not a cleanup job,” it said in its technical write-up, quoted by SecurityWeek. Source
Comments