Attacker Roots 21 N-central Servers, 19 Already on Latest Hotfix

An attacker took root control of 21 live N-able N-central servers on November 12, 2026, about five hours after researcher Sean Bales published a proof of concept called 4EverAble2Shell. Huntback, which tracked the attacks, says 19 victims were running Hotfix 2 (build 2026.4.1.26), the update N-able released on November 10 to close the earlier Able2Shell flaws.

The chain pairs Apache Axis bug CVE-2026-90436 (CVSS 9.8, Critical) with a local root escalation. N-able and Bales say it only works on on-premises servers with the non-default Legacy API switched on. The payload was a Monero miner held to half the CPU cores, and the operator’s public mining pool listed every victim: nine in the US, four each in South Africa and Canada, and the rest in the UK, Germany, France, and Sweden.

N-able had no patch as of November 13. On-premises admins should disable Legacy API, upgrade Agents and Probes, and search logs for POSTs to /dms/services/ServerUI naming jline.internal.TerminalLineSettings. Huntback says any hit should be treated as a full compromise.

Source: The Hacker News