N-central 4EverAble2Shell exploited: Hotfix 2 isn't enough

The patch your MSP applied this week did not close the door. A new N-central zero-day chain called 4EverAble2Shell went public on November 12, and attackers used it within hours. One security firm counted 21 compromised N-central servers. Nineteen of them were already on Hotfix 2, the update N-able shipped on November 10 after the Able2Shell disclosure we covered on Monday. If an MSP manages your laptops, this is the question for today.

What actually happened

Independent researcher Sean Bales released proof-of-concept exploits for two new sets of flaws, 4EverAble2Shell and Agent2Shell, on November 12, BleepingComputer reported.

• The chain. It starts with an Apache Axis flaw, CVE-2026-90436 (CVSS 9.8), and adds an N-central privilege escalation to reach root, per The Hacker News. BleepingComputer says it needs no login, but only works when N-central's Legacy API is turned on.
• Who got hit. Security firm Huntback found an XMRig Monero miner on 21 N-central servers. Nineteen ran Hotfix 2 (2026.4.1.26). Huntback's words: Hotfix 2 "is not enough on its own."
• How fast. Previdian saw probing at about 08:30 UTC on November 12, then full exploit attempts against its honeypot.
• N-able's response. It is "restricting certain N-central features and integrations." It turned off the Intune integration. It tells on-prem customers to upgrade Agents and Probes and to confirm the Legacy API is disabled. The Legacy API is off by default. N-able says it is developing further fixes. No fixed version is named yet.

Mining is the payload today. The access is root. The next attacker can do more with it.

Why it matters for your business

An RMM server is the console that patches, scripts and remotes into every machine your MSP manages. Root on that server is a bad day for every client on it, and that list may include you. It's also the second N-central zero-day wave in one week, after critical patches in August and September.

Send your MSP these questions today:

1. Do you run N-central on-prem? If yes, is the Legacy API off? Get a yes or no.
2. Did you check for compromise? BleepingComputer lists indicators: requests to /dms/services/ServerUI, an unexpected xvd.service, and files in /tmp/.xvd or /var/tmp/.xvd. Any hit means a full rebuild, not a cleanup.
3. Are Agents and Probes updated? That is N-able's own instruction.
4. What's your plan when the real fix ships? Ask for a date, not "soon."

Sources: BleepingComputer, The Hacker News, N-able status page.