Active Exploitation of N-able Flaws Plants Miners on 21 Servers

Researcher Sean Bales disclosed two vulnerability sets—4EverAble2Shell and Agent2Shell—in N-able N-central, a platform that manages customer endpoints. The flaws allow unauthenticated attackers to execute arbitrary code with root or SYSTEM-level access under specific conditions. N-able responded by restricting functionality in hosted environments: Legacy API is now disabled by default, and Intune integration has been temporarily disabled. Active exploitation is already underway, with threat actors leveraging the flaws across 21 N-central servers to deploy XMRig cryptocurrency miners.

The attack exploits CVE-2026-90436, an Apache Axis vulnerability (CVSS 9.8), combined with an N-central privilege escalation weakness to achieve root access. Attackers download and execute a shell script (“jup.sh”) from IP address 157.20.241.16 that deploys a cryptocurrency miner configured to use only half of available CPU cores to avoid detection. Of the 21 compromised servers scattered across the U.S., South Africa, Canada, the U.K., Germany, France, and Sweden, 19 were already running Hotfix 2—demonstrating that applying this patch alone does not prevent exploitation.

N-able recommends hosted customers and urges on-premises customers to upgrade Agents and Probes to version 2026.4 HF1 or above, which alters how Probe and Agent components communicate. On-premises deployments must also ensure Legacy API access is disabled. Compromised servers warrant treatment as fully compromised incidents: root-level attacker access translates to complete control over infrastructure managing customer endpoints, far exceeding the impact of the cryptocurrency miner alone.