A researcher published working exploits for N-able N-central on 12 November and attackers were using them the same morning. Within about four hours, 21 production servers were running a Monero miner, including hosts in South Africa.
What happened
The chain called 4EverAble2Shell needs no login. It first abuses Apache Axis 1.x, still bundled inside N-central, to instantiate an attacker-chosen class and run commands as the low-privilege nable account. That flaw is CVE-2026-90436, an unsafe reflection bug the Apache project will not fix because Axis 1 is end of life.
The second stage is an N-central privilege escalation that abuses the privileged setLDFileOwner helper and a symbolic link to make a root-owned script writable, then calls serverControl to run it as root. Security firm Previdian tracks that stage as VULN-2026-0009, and it has no CVE yet.
Researchers at Huntback found the 21 compromised servers by following the attacker's mining pool statistics. Nineteen were running N-central 2026.4.1.26, the Hotfix 2 build N-able shipped on 10 November, which means the patch did not close this path. The same attacker IP, 157.20.241.16, was seen probing honeypots from 08:30 UTC on 12 November.
Who is affected
Exposure depends on configuration, not just version.
- N-central servers, hosted or on-premises, with the Legacy API enabled and reachable from the internet. N-able says Legacy API is off by default, so most estates should not be reachable this way.
- MSPs and internal IT teams running N-central 2026.4 HF2 or earlier who have not yet restricted the server's web interface.
- Any customer whose devices are managed through a compromised N-central instance, because the platform holds agent-level control of those endpoints.
- A second chain, Agent2Shell, is claimed to give SYSTEM on managed Windows devices. No confirmed exploitation of that one has been reported.
What to do now
Confirm Legacy API is disabled and that the N-central web interface is not reachable from the public internet. That single control blocks the observed chain.
- Check for suspicious requests to /dms/services/ServerUI that reference jline.internal.TerminalLineSettings.
- Look for an unexpected xvd.service systemd unit, mining processes, and files under /tmp/.xvd or /var/tmp/.xvd.
- Treat any host matching those indicators as fully compromised: rebuild it, rotate every credential it held, and audit the managed endpoints it controlled.
- Follow N-able's status page for the feature and integration restrictions it applied on 12 November, including the disabled Intune integration.
What this means for South African businesses
RMM platforms are the highest-value foothold in the SME market: one compromised N-central server hands an attacker the same remote control your provider uses across dozens of client networks. South African hosts appearing in the miner list is not abstract, and an MSP here that exposes its management console is effectively exposing every client it serves.
Most local estates are safe because Legacy API is off by default, so the practical risk sits with providers who enabled it years ago for an integration and never turned it back off.
Source: BleepingComputer.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.