N-able 4EverAble2Shell Zero-Day Exploited After PoC

What happened

Attackers are exploiting the N-able N-central zero-day "4EverAble2Shell" to take over servers and install a cryptocurrency miner. BleepingComputer reported on November 12, 2026 that at least 21 systems are affected, including 19 on the latest security update.

Researcher Sean Bales released proof-of-concept exploits for 4EverAble2Shell and Agent2Shell the same day. He says they give root-level access to N-central appliances and SYSTEM-level access to Windows systems. The release came two days after N-able's emergency updates of November 10. We covered those in N-able Releases Hotfixes for Zero-Day Vulnerabilities.

Who is affected

N-central is a remote monitoring and management (RMM) platform. Managed service providers (MSPs) and IT teams use it to manage customer devices and networks. Bales tested the exploits against the hotfix, so being fully patched did not help.

The 21 compromised servers were in the United States, Canada, South Africa, the United Kingdom, Germany, France and Sweden. Further fixes are still in development, so check N-able's security advisory for updates.

How serious it is and whether it is exploited

It is exploited now, and it is serious. The 4EverAble2Shell exploit lets unauthenticated attackers run commands as root. It needs the Legacy API to be enabled.

The chain has two steps:

1. Apache Axis flaw CVE-2026-90436 runs commands as the nable service account.

2. A separate N-central privilege escalation gives root. Previdian tracks it as VULN-2026-0009. It abuses the setLDFileOwner helper and a symbolic link, then calls serverControl.

The timeline was fast. Previdian saw probing at about 08:30 UTC on November 12. Huntback saw full-chain attempts from 09:16 UTC. By 12:50 UTC it had found 21 active miners.

The payload downloads a shell script from 157.20.241[.]16 and installs XMRig Monero. The miner uses about half the CPU cores, which makes it harder to spot. Attackers could also use these servers against managed customer environments. N-able said it saw no signs of compromise, but researchers have since reported exploitation of production servers.

What to do now

Work through this list in order.

1. Confirm Legacy API access is disabled on every on-premises server. N-able says this is already the default.

2. Follow the November 12 advisory. N-able is restricting some features and integrations and has disabled the Intune integration. Hosted environments already have the protections.

3. Keep upgrading Agents and Probes under N-able's Hotfix 2 guidance.

4. Hunt for signs of compromise with the commands below.

Run these on the N-central server. Replace the log path if yours differs.

ps aux | grep -i [x]mrig
ss -tnp | grep 157.20.241.16
grep -r "157.20.241.16" /var/log 2>/dev/null | head
top -b -n1 | head -15

On Windows devices managed by the agent, check for connections to the same address:

Get-NetTCPConnection -RemoteAddress 157.20.241.16 -ErrorAction SilentlyContinue

Block 157.20.241.16 at your firewall as well. Treat it as an indicator, not proof. Attackers can change addresses.

Quick decision table

A root compromise means you cannot trust the box. Teams commonly rebuild from a known-good image and rotate credentials stored on it. Review customer devices the server managed, since miners are only the attack seen so far.

What learners can take from this

This incident shows why a patch is not the end of the work. Hotfix 2 was current, and servers on it were still compromised. Attack chains also join two small flaws, here a web service bug and a local privilege escalation. Learning to read logs, hunt for indicators and spot odd CPU use is core analyst work. The CompTIA CySA+ (CS0-003) voucher covers that skill set, and our cybersecurity certification page lists other options.

Sources

• New N-able "4EverAble2Shell" zero-day exploited hours after PoC released (BleepingComputer)