N-able N-central 4EverAble2Shell and Agent2Shell zero-days actively exploited for root/SYSTEM RCE and Monero mining, bypassing patch 2026.4.1.26
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 13/11/2026 00:03; os links antigos trazem para cá.
N-able is dealing with newly disclosed, unpatched flaws in on-premise N-central named 4EverAble2Shell and Agent2Shell, which affect version 2026.4.1 HF2 and bypass the patch 2026.4.1.26 released on November 10, 2026 for the earlier Able2Shell issues (thehackernews.com). The later report (bleepingcomputer.com, November 12) confirms in-the-wild exploitation shortly after proof-of-concept code was published by researcher Sean Bales. At least 21 compromised N-central production servers, 19 of them on the latest update 2026.4.1.26 HF2, were found running a XMRig Monero miner. Victims are in the US, Canada, South Africa, UK, Germany, France and Sweden (bleepingcomputer.com). 4EverAble2Shell gives unauthenticated remote code execution as root on N-central servers when the Legacy API is enabled. Agent2Shell executes commands as SYSTEM on managed Windows agents if the attacker knows the appliance ID (thehackernews.com). Hosted N-central environments are not affected (thehackernews.com). Servers showing any indicator should be treated as fully compromised.
Entenda a falha
A vulnerabilidade
CVE-2026-90436 is an unauthenticated Apache Axis flaw (CVSS 9.8 per The Hacker News) in on-premise N-able N-central. It gives command execution as the 'nable' service account. Chained with a separate N-central privilege escalation (VULN-2026-0009, per Previdian), it gives root. This chain is called 4EverAble2Shell and needs network reach to a server with the Legacy API enabled, which is off by default. Agent2Shell, reported only by The Hacker News, chains more than 10 zero-days to run commands as SYSTEM on managed Windows agents if the attacker knows the appliance ID. Version 2026.4.1.26 HF2 is affected, so the November 10 hotfix does not protect, and no fixed version is named. Hosted N-central is not affected. Patches for CVE-2026-90436 itself were reportedly released on November 6.
Como funciona
The attacker sends a request to the exposed Legacy API endpoint /dms/services/ServerUI, which reaches the Apache Axis component. The request references the Java class jline.internal.TerminalLineSettings and ends in command execution as 'nable'. In the second stage, the privileged setLDFileOwner helper is abused with a symbolic link so that a normally root-owned script becomes writable. The attacker edits the script and calls N-central's serverControl functionality, which runs the commands as root, then tries to restore the modified files. In the observed attacks, a shell script was downloaded and run to install an XMRig miner. Agent2Shell works differently: it targets the agent functionality to reach SYSTEM on Windows devices, but the articles do not detail its steps.
Por que é vulnerável
The articles give no detailed root cause for the Axis flaw beyond unauthenticated command execution reachable through the Legacy API. The privilege escalation comes from the privileged helper setLDFileOwner, which can be made to change file ownership through a symbolic link. That makes a root-owned script writable, and serverControl then runs it as root. The articles do not explain why the flaws went unnoticed or what a fix changes. N-able has so far applied mitigations (disabled the Intune integration, restricted features, Legacy API off by default) while it develops further fixes.
Onde está
The articles name the endpoint /dms/services/ServerUI, the Java class jline.internal.TerminalLineSettings, the helper setLDFileOwner and N-central's serverControl functionality; they name no source file or fixing commit.
Como foi descoberta
Independent researcher Sean Bales published the 4EverAble2Shell and Agent2Shell exploits on November 12, two days after N-able's emergency updates for earlier zero-days (Able2Shell) he had also disclosed publicly. He told BleepingComputer he prefers to release his research and let the vendor decide what to fix, and he criticized N-able's slow patching of flaws he had reported responsibly. Previdian saw probing at about 08:30 UTC from 157.20.241.16, and Huntback saw full chain attempts from 09:16 UTC. watchTowr also reported probes. Previdian tracks the escalation as VULN-2026-0009 and added it to its KEV catalog. N-able's advisory said it had seen no signs of compromise, but Huntback later found 21 compromised servers, 19 of them on 2026.4.1.26 HF2.
PoC pública
Bales published public proof-of-concept exploits on GitHub for both 4EverAble2Shell and Agent2Shell, tested against N-central Appliance 2026.4.1.26 HF2. The 4EverAble2Shell one gives unauthenticated root command execution on servers with the Legacy API enabled, and the observed attacks match it. Attackers used it within hours: Huntback confirmed at least 21 compromised production servers running an XMRig miner. Exploitation of Agent2Shell has not been reported. Urgency is high: disable the Legacy API now, and treat any server showing the indicators as fully compromised.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 00:19.
Detalhes técnicos
- Attack chain: the unauthenticated Apache Axis flaw CVE-2026-90436 (rated high severity by thehackernews.com) runs commands as the
nableservice account. A privilege escalation then abuses thesetLDFileOwnerhelper plus a symbolic link to get root. The escalation flaw is tracked as VULN-2026-0009 by Previdian (bleepingcomputer.com). - Payload: the attacker downloads and runs a shell script that installs an XMRig Monero miner configured to use about half of the CPU cores to reduce the chance of detection (bleepingcomputer.com).
- Agent2Shell: it chains multiple zero-day flaws to get SYSTEM on managed Windows agents (thehackernews.com).
- Scanning: active probing was observed from IP 157.20.241.16, using CVE-2026-90436 as the initial access vector (thehackernews.com).
- Indicators (bleepingcomputer.com):
- suspicious requests to
/dms/services/ServerUI - an unexpected systemd service named
xvd.service - mining processes
- temporary files in
/tmp/.xvdor/var/tmp/.xvd
- suspicious requests to
Remediação
- Disable the Legacy API, or verify it is off. It is disabled by default and risk arises mainly when it is enabled and exposed to the internet (thehackernews.com, bleepingcomputer.com).
- N-able has disabled the Intune integration and restricted some N-central features while it works on fixes (bleepingcomputer.com).
- Upgrade Agents and Probes as described in the earlier Hotfix 2 guidance (bleepingcomputer.com).
- Hunt for the indicators above. If any are found, treat the server as fully compromised and start incident response immediately (bleepingcomputer.com).
- Block or monitor traffic from 157.20.241.16 (thehackernews.com).
Relatos divergentes
- Patch status: thehackernews.com says the exploits bypass patch 2026.4.1.26. bleepingcomputer.com says 19 of the compromised servers were already on 2026.4.1.26 HF2, which is consistent with that. Neither source gives a fixed version.
- Exploitation status: thehackernews.com (earlier, 11:51 UTC) describes N-able as investigating and reports probing activity. bleepingcomputer.com (later, 19:51 UTC) confirms active exploitation and cryptomining, so it is the more current account.
- Agent2Shell: only thehackernews.com covers it. bleepingcomputer.com does not mention it or any exploitation of it.
Linha do tempo
-
Active Exploitation of N-able N-central 4EverAble2Shell Zero-Day Enables Root Access and Cryptomining
ler a análise desta fonte ocultar
A newly disclosed zero-day vulnerability in N-able N-central, dubbed "4EverAble2Shell," is actively exploited in the wild shortly after proof-of-concept exploits were published by researcher Sean Bales. This vulnerability allows unauthenticated attackers to execute commands as root on vulnerable N-central servers if the Legacy API is enabled. The attack chain exploits CVE-2026-90436 (Apache Axis) combined with an N-central privilege escalation flaw (tracked as VULN-2026-0009 by Previdian). At least 21 compromised N-central production servers, including 19 using the latest security update 2026.4.1.26 HF2, were identified mining Monero cryptocurrency. Victims span several countries including the US, Canada, South Africa, UK, Germany, France, and Sweden. N-able has disabled some features and urges users to disable Legacy API, which is now off by default. Organizations running N-central should urgently verify their environments for signs of this exploitation and consider the affected servers fully compromised if indicators are observed.
Technical Details
The exploitation combines an unauthenticated Apache Axis vulnerability (CVE-2026-90436) to execute commands as the 'nable' service account, followed by a privilege escalation through misuse of the setLDFileOwner helper and a symbolic link, enabling root-level command execution. The attacker then downloads and executes a shell script that installs an XMRig Monero miner configured to use approximately half of the CPU cores to reduce detection likelihood.
Remediation
N-able has disabled the Intune integration and restricted certain N-central features while addressing vulnerabilities. Legacy API is disabled by default and should be verified as off. Users should upgrade Agents and Probes as instructed in the previous Hotfix 2 guidance. Detection measures include monitoring for suspicious requests to /dms/services/ServerUI, unexpected systemd services named xvd.service, mining processes, and temporary files in /tmp/.xvd or /var/tmp/.xvd. Any detection of these IOCs should be treated as a full system compromise requiring immediate incident response.
-
New 4EverAble2Shell and Agent2Shell Exploits Target N-able N-central 2026.4.1 HF2, Enabling Root and SYSTEM RCE
ler a análise desta fonte ocultar
N-able is investigating newly disclosed vulnerabilities named 4EverAble2Shell and Agent2Shell affecting on-premise N-central version 2026.4.1 HF2. The primary risk arises when the Legacy API feature—disabled by default—is enabled and exposed to the public internet. 4EverAble2Shell allows unauthenticated remote code execution with root privileges on N-central servers, while Agent2Shell exploits multiple zero-day flaws to execute commands as SYSTEM on managed Windows agents if the attacker knows the appliance ID. These exploits bypass the recent patch 2026.4.1.26 released November 10, 2026, for the earlier Able2Shell vulnerabilities. Active probing has been observed from IP 157.20.241.16 leveraging also the high-severity CVE-2026-90436 Apache Axis vulnerability as an initial access vector. Hosted N-central environments are not affected. Immediate disablement of Legacy API is strongly advised by N-able.