Huntback reports N-central zero-day used to deploy cryptocurrency miners

This is a new development in a story we reported earlier: N-able takes N-central cloud offline after 33 alleged zero-days disclosed.

Huntback said attackers used the 4EverAble2Shell chain on November 12, 2026 to download a script that installed an XMRig Monero cryptocurrency miner on compromised production servers.

N-able took its hosted N-central environments offline on November 9, 2026, after researcher Sean Bales published more than 30 alleged zero-day vulnerabilities called Able2Shell, and urged on-premises customers to shut down servers. On Nov. 10, 2026, N-able issued build 2026.4.1.26 of N-central 2026.4 HF2 to fix earlier Able2Shell vulnerabilities researcher Sean Bales disclosed. Sean Bales put proof-of-concept code for 4EverAble2Shell and Agent2Shell out on Nov. 12, 2026, testing it against N-central Appliance 2026.4.1.26 HF2.

N-central is a remote monitoring and management platform that MSPs and IT teams use to manage customer devices and networks remotely. Huntress said attackers could use the chains to reach the endpoints managed by an exposed N-central server.

The 4EverAble2Shell exploit allows unauthenticated attackers to run commands with root, or administrative, privileges on exposed N-central servers solely when Legacy API is turned on. The chain links Apache Axis flaw CVE-2026-90436 with a distinct N-central privilege escalation flaw for root access. The initial step runs commands under the nable service account through Apache Axis CVE-2026-90436, followed by escalation to root privileges.

Previdian said attackers misuse N-central’s setLDFileOwner helper using a symbolic link to make a root-owned script writable. The serverControl function in N-central lets attackers run commands as root, and they attempt to restore the modified files. The payload attempted to fetch and execute a shell script hosted at attacker-controlled address 157.20.241[.]16, sending diagnostic information and command output back there.

Huntback said attackers leveraged the 4EverAble2Shell chain to fetch a script that deployed an XMRig miner for Monero on compromised production servers. Attackers configured the miner to use roughly half of the available CPU cores, apparently to hide the mining activity. Huntback identified additional compromised systems by reviewing the attacker’s mining pool statistics, where infected systems use identifiers starting with nc_ followed by the server IP address.

Huntback said that at 12:50 UTC on Nov. 12, 2026, researchers tallied 21 active miners tagged with nc_, and all submitted shares within the previous five minutes. Huntback observed the same attacker IP address that Previdian saw probing its N-central honeypots around 08:30 UTC on Nov. 12, 2026, with full exploit attempts beginning at 09:16 UTC. Affected servers spanned multiple countries including the United States, Canada, South Africa, the United Kingdom, Germany, France, and Sweden. Previdian later confirmed that attackers attempted the full exploit chain against its honeypot server following initial probing, and it tracks the N-central privilege escalation flaw as VULN-2026-0009 in its own Known Exploited Vulnerabilities catalog.

Huntback said most observed attacks involved cryptojacking, or unauthorized cryptocurrency mining, but warned that compromised N-central infrastructure could enable further malicious activity against managed customer environments. N-able said it has seen no signs of compromise involving the new flaws, while security researchers report successfully exploiting production N-central servers. N-able said it had not observed active exploitation of Able2Shell vulnerabilities by Nov. 9 at 15:15:00 UTC.

Huntress said any fully patched N-central server must be treated as vulnerable because no fix existed at the time of its writing. A server on 2026.4 HF2 with Legacy API disabled is not exposed to the 4EverAble2Shell exploit chain.

Huntress said as of Thursday morning, Nov. 12, 2026, it had not observed exploitation of the new issues in its partners’ environments.

Legacy API covers functionality including a SOAP API that has been inactive by default since the launch of N-central 2025.4 in November 2025. N-able stated that the server issue hinges on a non-default configuration with Legacy API turned on and exposed to the public internet, and that Legacy API remains off by default. Sean Bales updated his GitHub repository to confirm that 4EverAble2Shell only works with Legacy API turned on, and said he is working to remove it.

Defenders should confirm that Legacy API is turned off and look for suspicious requests to /dms/services/ServerUI, especially those mentioning jline.internal.TerminalLineSettings. Huntback advises looking for unexpected xvd.service systemd services and cryptocurrency mining processes, plus files under /tmp/.xvd or /var/tmp/.xvd.

Because 4EverAble2Shell grants full root access, organizations that spot these indicators should treat the incident as a complete server compromise. Huntress advises that organizations take on-premises N-central servers offline or cut them off from the internet even after applying 2026.4 HF2, keeping them offline until N-able issues guidance. Huntress says organizations should review server and endpoint activity from Nov. 11 for new administrator accounts, scripts, scheduled tasks or remote sessions.

N-able said it turned off the Intune integration as a precaution and urged on-premises customers to make sure Legacy API access is turned off, which is already the default. N-able restored hosted environments by Tuesday, Nov. 10, 2026, after patching them, and issued a new self-hosted version including a hotfix. In a Nov. 12, 2026 advisory, N-able restricted certain N-central features and integrations while developing further fixes, and applied the protections to hosted environments.

watchTowr said on Thursday morning, Nov. 12, 2026, that it had already seen probes targeting 4EverAble2Shell. Censys data shows 1,728 N-central instances exposed to the internet.

N-able president and CEO John Pagliuca accused Bales of endangering customers by publishing exploit code before they could act. N-able said Bales provided no prior warning and that flaws published on Nov. 9, 2026, were not responsibly disclosed through its established reporting channels.

Sean Bales criticized N-able’s disclosure handling, saying N-able has not patched two unrelated remote code execution flaws in another N-able product disclosed in July. N-able refuted Bales’s claim that it ignored responsible disclosure but did not mention previous vulnerability reports from the researcher. SecurityWeek describes CVE-2026-125878 as an XSS flaw, while Huntress describes it as an OGNL injection vulnerability. The sources disagree on how to classify the flaw.

It's much much easier for me to just release the research I have

Sean Bales, BleepingComputer

Publishing exploit code before customers have had the chance to act doesn't make anyone safer.

John Pagliuca, president and CEO of N-able, BnkInfoSecurity

On Sept. 5, 2026, N-able patched CVE-2026-86218, described as a pre-authentication remote code execution flaw in N-central, with Hotfix 4 for N-central 2026.3 bringing the build to 2026.3.1.14. In August 2026, N-able released a hotfix for CVE-2026-18556, described as an unauthenticated flaw granting god-mode access to the N-central console, followed by CVE-2026-18577 as an incomplete patch.

Agent2Shell targets N-central agent functionality and is claimed to allow command execution with SYSTEM privileges on Windows devices. Agent2Shell is a set of more than 10 issues; two chains let unauthenticated attackers run commands on managed Windows endpoints as SYSTEM. Huntress said attackers could use the chains to reach the endpoints managed by an exposed N-central server. Huntress has not confirmed whether Agent2Shell chains affecting Windows Agents and Probes also depend on Legacy API.

Attackers are still probing exposed N-central instances. Defused said initial scanning began on Monday and saw anonymous agent sessions, appliance config access and unauthenticated remote-control endpoint hits. Rapid7 said attackers exploit publicly known vulnerabilities on average three days after details become public.

N-able said it has now resolved every vulnerability exploitable without authentication. N-able said remaining vulnerabilities require an authenticated account, often with elevated rights or other conditions, and it will patch them in later hotfixes. HF2 resolves seven CVEs including CVE-2026-125883, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-91000 and CVE-2026-125882.

N-able said Ecoverse services under N-able Login remain available, including Asset View, Patching, Vulnerability Management, scripting, policies and tagging.

A new N-able knowledge base article covers turning off Legacy API on on-premises servers, and the company is not instructing customers to take N-central offline. Huntress is closely investigating and will share updates. N-able does not always alter version numbers for live hotfixes that do not require a reboot. Huntress cites that as a reason to confirm patching through release notes rather than build strings alone.