Threat watch / Vulnerability
N-able N-central: 33 flaws published, then cryptominers on 21 servers despite the hotfix
A researcher published details and proof-of-concept code for 33 unpatched flaws in N-able N-central, the remote monitoring and management tool used by managed service providers, chained into four exploits he calls "Able2Shell". On November 9, 2026, N-able took its hosted N-central environment offline "as a precautionary measure" and told on-premises customers to keep their servers offline until a fix ships. At first, N-able said it had seen no evidence that the flaws were exploited. A hotfix shipped on November 10; a day later the researcher published two new exploit chains that work against it, which N-able says only reach servers with the non-default Legacy API turned on and exposed to the internet. Within hours, attackers used the new chain: researchers at Huntback and Lupovis found a Monero miner on 21 N-central servers, 19 of them already running the hotfix. N-able says it found additional indicators of compromise, is working with those customers, and is restricting some N-central features and integrations while it fixes the flaws.
- Sector
- Tech & SaaS
- Way in
- Software flaw
- Product or vendor
- N-able N-central
- How it happened
- Researcher Sean Bales published 33 flaws in the N-central Appliance 2026.4.0.31 (and "likely earlier versions", says Huntress) on GitHub, with proof-of-concept code. They include credential disclosure, arbitrary file writes, directory traversal, XSS and XXE. Chained, three of the four exploits lead to remote code execution and one to privilege escalation to root, according to Huntress. SecurityWeek reports he released them after N-able failed to patch flaws he had reported in another product. N-able's November 10 hotfix lists seven CVEs, including XXE, OGNL injection, SSRF and a path traversal leading to remote code execution. On November 11 he published two more chains that work against that hotfix: 4EverAble2Shell (unauthenticated remote code execution as root on the server) and Agent2Shell (commands run as SYSTEM on managed Windows machines). N-able says the server chain needs the non-default Legacy API turned on and exposed to the internet. In the attacks seen from November 12, according to Huntback and Lupovis via SecurityWeek and The Hacker News, the attackers used an Apache Axis flaw (CVE-2026-90436) to run code, then a separate N-central flaw to become root, and installed the XMRig miner.[1][2][3][4][5][6][7] Checked 13 Nov 2026
- What was stolen
- Computing power: the attackers ran a Monero miner on half the CPU cores of the compromised servers. No theft of data or money has been reported. Huntback warns that the attackers got root "on a host that manages your customers' endpoints".[6][7] Checked 13 Nov 2026
- Who was impacted
- Customers of N-central. The hosted service (Americas, APAC and Europe) was taken offline on November 9, then upgraded and brought back online on November 10, according to Huntress; N-able says hosted servers are not vulnerable to the November 11 chain. On-premises servers must install the hotfix and keep the Legacy API off. From November 12, 21 servers were found with a miner, in the US (9), South Africa (4), Canada (4), the UK, Germany, France and Sweden, according to Lupovis via SecurityWeek. No managed service provider or customer has been named.[1][4][5][6][7] Checked 13 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2026-90436, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, CVE-2026-125883, CVE-2026-91000
Timeline
- Researcher Sean Bales publishes "Able2Shell" on GitHub: details and proof-of-concept code for more than 30 N-central flaws, according to SecurityWeek. [2][3]
- N-able takes hosted N-central offline: "As a precautionary measure, we are temporarily taking our Hosted N-central environment offline". Huntress says N-able had seen no active exploitation as of November 9 at 15:15 UTC, and tells on-premises customers to take their servers offline and review logins and audit logs from November 8 onward. [1][2][3]
- SecurityWeek reports N-able expects its hotfix to roll out around midday on November 10 and says it has "no evidence" the flaws were exploited against its N-central environments. [2]
- N-able releases N-central 2026.4 Hotfix 2 (build 2026.4.1.26), a "critical security update" that fixes seven CVEs. Huntress reports N-able saw scanning activity linked to the published proof-of-concept code but no evidence that any customer environment was successfully exploited. [1][4]
- Late on November 11, the researcher publishes two more sets of exploit code, 4EverAble2Shell and Agent2Shell, that work against the Hotfix 2 build, according to Huntress and The Hacker News. [1][5]
- N-able says the server issue "depends on a non-default configuration" where the Legacy API is turned on and exposed to the public internet, urges customers to disable it, and says hosted environments are not affected. Huntress says N-able is not advising customers to take N-central offline, and that it has not seen exploitation in its partners' environments. The Hacker News reports targeted probing within hours of the new code's release, with no evidence of successful exploitation. [1][5]
- About five hours after the proof-of-concept is published, attackers start using it, according to Lupovis and Huntback. Huntback reports the XMRig miner on 21 N-central servers, 19 of them on Hotfix 2: "Applying Hotfix 2 is not enough on its own." Previdian also reports exploitation. [6][7]
- N-able says it has "identified additional indicators of compromise (IoCs)" and is "working closely with those specific customers". It is "restricting certain N-central features and integrations": the Legacy API is now off by default on hosted servers, the Intune integration is turned off, and all customers must upgrade their Agents and Probes. No fix for the new chain has been announced. [6][7]