N-able N-central '4EverAble2Shell' Exploited Within Hours of Public PoC: Unauthenticated Root Chain Turns 21 RMM Servers Into Monero Miners

Critical · 2026-11-13 · By H.A

A public exploit chain giving unauthenticated root on N-central servers with the Legacy API enabled was used within hours on 12 November, and at least 21 production servers, most on the new 2026.4.1.26 HF2 build, are now running XMRig.

Overview

The N-able N-central story moved from disclosure to active exploitation on 12 November 2026. Hours after a researcher published proof-of-concept code for a new chain called 4EverAble2Shell, honeypots recorded attackers using it. By that afternoon researchers counted 21 production N-central servers quietly mining Monero.

Earlier in the week N-able took its hosted N-central environments offline. That followed the same researcher's release of more than 30 alleged zero-days in the remote monitoring and management (RMM) platform, and N-able urged on-premises customers to shut their servers down. What is new: a fresh unauthenticated root chain, public exploit code, and confirmed compromises of real servers, most of them running the hotfix released on 10 November.

The Vulnerability

4EverAble2Shell gives an unauthenticated attacker root command execution on Linux-based N-central appliances. It only works when the Legacy API is enabled. The chain has two stages:

• Initial execution: an Apache Axis flaw, CVE-2026-90436, reached through the /dms/services/ServerUI endpoint, runs commands as the nable service account.
• Privilege escalation: a separate N-central weakness, tracked by one research team as VULN-2026-0009, abuses the privileged setLDFileOwner helper and a symbolic link to make a root-owned script writable. The attacker edits the script, triggers it through serverControl to run commands as root, then tries to put the original files back.

The researcher tested the chain against N-central Appliance 2026.4.1.26 HF2, the build released on 10 November. They also released a second chain, Agent2Shell, which they say gives SYSTEM-level command execution on Windows devices through the N-central agent. No exploitation of Agent2Shell has been reported so far.

Timeline

• Earlier in the week: more than 30 alleged N-central zero-days are published. N-able takes hosted N-central offline and tells on-prem customers to shut down.
• 10 November: N-central 2026.4.1.26 HF2 is released.
• 12 November: proof-of-concept code for 4EverAble2Shell and Agent2Shell goes public.
• ~08:30 UTC, 12 November: one IP address starts probing honeypots run by two separate research teams, using the same Java class as the public exploit.
• 09:16 UTC: full exploit-chain attempts begin.
• 12:50 UTC: researchers count 21 active miners on compromised N-central servers.
• 12 November: N-able publishes an advisory restricting features and integrations.

Tradecraft

The observed operator is after money rather than espionage, at least so far. After gaining root, the chain downloads a shell script that installs the XMRig Monero miner. The miner is set to use about half of the CPU cores, likely so the slowdown is less noticeable. Each infected server joins the mining pool with a worker ID made of nc_ and the server's IP address. That naming let researchers count the victims: 21 servers, 19 of them on 2026.4.1.26, located in the US, Canada, South Africa, the UK, Germany, France and Sweden.

The bigger risk is the next attacker. Root on an RMM server means control of every endpoint it manages. A cryptominer is the mildest thing someone can do with that access.

Indicators of Compromise

• Attacker IP (payload delivery and output exfiltration): 157.20.241[.]16
• Requests to /dms/services/ServerUI, especially any that reference jline.internal.TerminalLineSettings
• An unexpected systemd service named xvd.service
• Files under /tmp/.xvd or /var/tmp/.xvd
• XMRig or other mining processes, and mining-pool connections from the appliance

Detection

Check web logs on the appliance for POSTs to the Axis endpoint, and check the host for the persistence artefacts:

# Suspicious Axis requests
grep -R "dms/services/ServerUI" /var/log/ 2>/dev/null | grep -i "TerminalLineSettings"

# Persistence and staging
systemctl list-unit-files | grep -i xvd
ls -la /tmp/.xvd /var/tmp/.xvd 2>/dev/null

# High-CPU processes and outbound connections
ps aux --sort=-%cpu | head -15
ss -tnp | grep -v "127.0.0.1"

Network teams should alert on connections to the IP above and to public Monero pool ports from RMM servers. If you find a compromised appliance, treat every managed endpoint as possibly exposed. Review recent scripts, jobs and agent deployments pushed from N-central.

Recommended Actions

• Confirm the Legacy API is disabled on on-prem N-central servers. N-able says disabled is the default. Verify it rather than assuming.
• Follow N-able's guidance to keep shutting servers down, or keep them isolated from the internet until fixes for the published chains ship.
• Keep Agents and Probes updated under the Hotfix 2 guidance. Note that N-able has disabled the Intune integration as a precaution.
• Restrict the N-central web interface to management networks or VPN only.
• Rotate N-central administrator credentials and any API keys or service-account secrets stored in the platform if you find signs of compromise.

Analyst Assessment

Exploitation started within hours of the code going public, and the vendor's own guidance fell behind events. N-able's advisory said it had seen no compromise even as researchers counted working miners on production servers. This is now a public, root-level, unauthenticated chain against a tool that controls fleets of customer endpoints. Expect more capable operators to follow the miners, including ransomware affiliates who already favour RMM platforms. Until N-able ships fixes for the full set of published issues, the safest N-central server is one the internet cannot reach.