Overview
- Researcher Sean Bales published more than 30 N-central flaws called Able2Shell and then released two new PoCs, 4EverAble2Shell and Agent2Shell, that were shown to work against patched servers.
- N-able issued emergency Hotfix 2 on November 10 to fix unauthenticated flaws but researchers reported that the November 12 PoCs can still succeed when the non-default Legacy API is exposed.
- Attackers are chaining an Apache Axis vulnerability (CVE-2026-90436) for initial code execution with an N-central privilege escalation that abuses the setLDFileOwner helper and a symlink to gain root or SYSTEM access.
- Security teams observed rapid scanning and active exploitation that has compromised at least 21 N-central servers and deployed XMRig Monero miners, prompting investigators to treat affected appliances as fully compromised.
- N-able has applied mitigations including disabling certain integrations and urging customers to disable the Legacy API and install hotfixes, and MSPs must audit I/O to attacker IPs, check for mining processes, and assume full server takeover if exploitation indicators are found.