---
title: Attacker Roots 21 N-central Servers, 19 Already on Latest Hotfix
description: One attacker weaponized a fresh N-central exploit chain within hours of its release. N-able has no fix yet and is telling admins to disable Legacy API.
canonical_url: https://codekeeper.co/ticker/attacker-roots-21-n-central-servers-19-already-on-latest-hotfix
---

[Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities) | [Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# Attacker Roots 21 N-central Servers, 19 Already on Latest Hotfix

One attacker weaponized a fresh N-central exploit chain within hours of its release. N-able has no fix yet and is telling admins to disable Legacy API.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 13, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattacker-roots-21-n-central-servers-19-already-on-latest-hotfix%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattacker-roots-21-n-central-servers-19-already-on-latest-hotfix%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattacker-roots-21-n-central-servers-19-already-on-latest-hotfix%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattacker-roots-21-n-central-servers-19-already-on-latest-hotfix%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattacker-roots-21-n-central-servers-19-already-on-latest-hotfix%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattacker-roots-21-n-central-servers-19-already-on-latest-hotfix%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

An attacker took root control of 21 live N-able N-central servers on November 12, 2026, about five hours after researcher Sean Bales published a proof of concept called 4EverAble2Shell. Huntback, which tracked the attacks, says 19 victims were running Hotfix 2 (build 2026.4.1.26), the update N-able released on November 10 to close the earlier Able2Shell flaws. The chain pairs Apache Axis bug CVE-2026-90436 (CVSS 9.8, Critical) with a local root escalation. N-able and Bales say it only works on on-premises servers with the non-default Legacy API switched on. The payload was a Monero miner held to half the CPU cores, and the operator’s public mining pool listed every victim: nine in the US, four each in South Africa and Canada, and the rest in the UK, Germany, France, and Sweden. N-able had no patch as of November 13. On-premises admins should disable Legacy API, upgrade Agents and Probes, and search logs for POSTs to /dms/services/ServerUI naming jline.internal.TerminalLineSettings. Huntback says any hit should be treated as a full compromise. Source: [The Hacker News](https://thehackernews.com/2026/11/hackers-exploit-n-central-flaws-to.html)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattacker-roots-21-n-central-servers-19-already-on-latest-hotfix%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattacker-roots-21-n-central-servers-19-already-on-latest-hotfix%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattacker-roots-21-n-central-servers-19-already-on-latest-hotfix%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattacker-roots-21-n-central-servers-19-already-on-latest-hotfix%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattacker-roots-21-n-central-servers-19-already-on-latest-hotfix%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattacker-roots-21-n-central-servers-19-already-on-latest-hotfix%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks One Toolmaker May Be Arming Three China-Nexus Espionage Campaigns Nov 13, 2026](https://codekeeper.co/ticker/one-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns)

[Vulnerabilities Two Planted Pings Can Knock Out a Freshly Elected MongoDB Primary Nov 13, 2026](https://codekeeper.co/ticker/two-planted-pings-can-knock-out-a-freshly-elected-mongodb-primary)

[Vulnerabilities Feds Order Fast Fixes as Hackers Abuse OpenSSH’s SSHole Bug Nov 10, 2026](https://codekeeper.co/ticker/feds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug)

[Cyberattacks Jailbroken DeepSeek Agent Ran a Telecom Hack Mostly Unsupervised Nov 10, 2026](https://codekeeper.co/ticker/jailbroken-deepseek-agent-ran-a-telecom-hack-mostly-unsupervised)