N-able N-central '4EverAble2Shell' Exploited Within Hours of Public PoC: Unauthenticated Root Chain Turns 21 RMM Servers Into Monero Miners

Critical · 2026-11-13 · By H.A

N-able N-central '4EverAble2Shell' Exploited Within Hours of Public PoC: Unauthenticated Root Chain Turns 21 RMM Servers Into Monero Miners

A public exploit chain giving unauthenticated root on N-central servers with the Legacy API enabled was used within hours on 12 November, and at least 21 production servers, most on the new 2026.4.1.26 HF2 build, are now running XMRig.

Overview

The N-able N-central story moved from disclosure to active exploitation on 12 November 2026. Hours after a researcher published proof-of-concept code for a new chain called 4EverAble2Shell, honeypots recorded attackers using it. By that afternoon researchers counted 21 production N-central servers quietly mining Monero.

Earlier in the week N-able took its hosted N-central environments offline. That followed the same researcher's release of more than 30 alleged zero-days in the remote monitoring and management (RMM) platform, and N-able urged on-premises customers to shut their servers down. What is new: a fresh unauthenticated root chain, public exploit code, and confirmed compromises of real servers, most of them running the hotfix released on 10 November.

The Vulnerability

4EverAble2Shell gives an unauthenticated attacker root command execution on Linux-based N-central appliances. It only works when the Legacy API is enabled. The chain has two stages:

The researcher tested the chain against N-central Appliance 2026.4.1.26 HF2, the build released on 10 November. They also released a second chain, Agent2Shell, which they say gives SYSTEM-level command execution on Windows devices through the N-central agent. No exploitation of Agent2Shell has been reported so far.

Timeline

Tradecraft

The observed operator is after money rather than espionage, at least so far. After gaining root, the chain downloads a shell script that installs the XMRig Monero miner. The miner is set to use about half of the CPU cores, likely so the slowdown is less noticeable. Each infected server joins the mining pool with a worker ID made of nc_ and the server's IP address. That naming let researchers count the victims: 21 servers, 19 of them on 2026.4.1.26, located in the US, Canada, South Africa, the UK, Germany, France and Sweden.

The bigger risk is the next attacker. Root on an RMM server means control of every endpoint it manages. A cryptominer is the mildest thing someone can do with that access.

Indicators of Compromise

Detection

Check web logs on the appliance for POSTs to the Axis endpoint, and check the host for the persistence artefacts:

# Suspicious Axis requests
grep -R "dms/services/ServerUI" /var/log/ 2>/dev/null | grep -i "TerminalLineSettings"

# Persistence and staging
systemctl list-unit-files | grep -i xvd
ls -la /tmp/.xvd /var/tmp/.xvd 2>/dev/null

# High-CPU processes and outbound connections
ps aux --sort=-%cpu | head -15
ss -tnp | grep -v "127.0.0.1"

Network teams should alert on connections to the IP above and to public Monero pool ports from RMM servers. If you find a compromised appliance, treat every managed endpoint as possibly exposed. Review recent scripts, jobs and agent deployments pushed from N-central.

Recommended Actions

Analyst Assessment

Exploitation started within hours of the code going public, and the vendor's own guidance fell behind events. N-able's advisory said it had seen no compromise even as researchers counted working miners on production servers. This is now a public, root-level, unauthenticated chain against a tool that controls fleets of customer endpoints. Expect more capable operators to follow the miners, including ransomware affiliates who already favour RMM platforms. Until N-able ships fixes for the full set of published issues, the safest N-central server is one the internet cannot reach.

REEF SENTINEL