Has 4EverAble2Shell already reached your N-central server?
Security researchers, cited by BleepingComputer, report active exploitation of 4EverAble2Shell against production N-central servers, including 2026.4 HF2, build 2026.4.1.26. There is no patch yet. N-able says to make sure the Legacy API is disabled; it is off by default. Our advice: confirm it is off, keep N-central off the open internet, block 157.20.241[.]16, and watch for a fixed build. Any hit means a full root compromise: isolate, rebuild, and rotate credentials.
4EverAble2Shell is being exploited, including on 2026.4 HF2. No patch yet. Disable the Legacy API now.
Security researchers, cited in a BleepingComputer report published at 19:51 GMT on 12 November 2026, say 4EverAble2Shell is being used against production N-central servers, including 19 of at least 21 compromised servers that were running 2026.4 HF2, build 2026.4.1.26. There is no patch yet for 4EverAble2Shell, and it has no CVE of its own. The report describes a chain that uses Apache Axis CVE-2026-90436, which CISA's enrichment on NVD rates Critical, CVSS 3.1 9.8, and which is marked unsupported when assigned. N-able's current 12 November update, (incident 202613, status Identified when we checked at 12 November 2026, 20:33 GMT) says to make sure Legacy API access is disabled. That setting is off by default. N-able also says it has disabled the Intune integration as a precaution, that it has applied temporary protections to hosted environments, and that hosted customers need take no server-side action. It is developing additional remediation. Critical by impact, for 4EverAble2Shell itself, is our framing, not a vendor score, because N-able has published no CVE and no score for that issue.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 12 November 2026, 20:33 GMT.
At a Glance
Based on N-able's 12 November 2026 advisories, a BleepingComputer report published at 19:51 GMT the same day, The Hacker News, the official CVE and NVD records for CVE-2026-90436, and CISA's KEV catalogue, checked at 12 November 2026, 20:33 GMT. Last updated 12 November 2026, 20:33 GMT.
Critical (by impact); Axis CVE 9.8
There is no CVE and no CVSS score for 4EverAble2Shell itself. Critical by impact is our framing, because security researchers, cited by BleepingComputer and earlier by The Hacker News, describe unauthenticated remote code execution as root on the N-central server. That is not a vendor rating. The Apache Axis issue used in the reported chain, CVE-2026-90436, is rated Critical, CVSS 3.1 9.8, by CISA's enrichment on NVD, and is marked unsupported when assigned. Apache rates that Axis issue critical and does not expect a fixed Axis 1.x release.
Exploited, per researchers; no patch yet
A BleepingComputer report published at 19:51 GMT on 12 November 2026, citing security researchers, says 4EverAble2Shell is being exploited against production servers, including 2026.4 HF2. N-able has not announced a fixed build for 4EverAble2Shell. Its 12 November update says it is developing additional remediation, and that the current steps are to keep the Legacy API disabled, keep the Intune integration off as a precaution, and continue upgrading Agents and Probes. In that same advisory, N-able said it had seen no signs of compromise. That wording predates the later BleepingComputer report.
On-premises N-central; hosted have protections
N-able's 12 November update covers hosted and on-premises N-central in the Americas, APAC and Europe. It says Legacy API access is disabled by default, and that on-premises customers should make sure it is disabled. It has applied temporary protections to hosted environments, and says hosted customers need take no server-side action. Security researchers, cited by BleepingComputer, report at least 21 compromised production servers, 19 of them on 2026.4.1.26, in the United States, Canada, South Africa, the United Kingdom, Germany, France and Sweden. Those figures are the researchers', not N-able's.
No patch; disable the Legacy API; watch for a fix
There is no patch for 4EverAble2Shell. N-able says: make sure Legacy API access is disabled (it is off by default; if you enabled it, disable it now, using N-able's how-to article). It has disabled the Intune integration as a precaution. Hosted customers need take no server-side action, and should still upgrade Agents and Probes. On-premises customers should also continue the earlier HF2 guidance, including Agent and Probe upgrades. 2026.4 HF2 remains required for the earlier Able2Shell flaws, but it does not fix 4EverAble2Shell. Watch N-able Uptime for a fixed build.
CVE-2026-90436, a flaw in Apache Axis 1.x, was published on 6 November 2026 (the NVD record at 16:18 GMT). Apache Axis 1.x is end of life, and Apache does not expect a fixed 1.x release. Apache rates the issue critical. CISA's enrichment on NVD gives CVSS 3.1 9.8, Critical. The record is marked unsupported when assigned. Security researchers, cited later by BleepingComputer, describe this CVE in the 4EverAble2Shell attack chain. We have not independently verified that N-central uses Axis 1.x, and we do not assert that it does beyond what those sources report.
N-able released N-central 2026.4 HF2, build 2026.4.1.26, for the earlier Able2Shell vulnerabilities. Our guide to that disclosure is linked below. That hotfix does not fix 4EverAble2Shell.
CISA's Known Exploited Vulnerabilities catalogue 2026.11.10 was released. When we checked at 12 November 2026, 20:33 GMT, this was still the current catalogue. It predates the 12 November activity.
N-able posted a critical security incident advisory on Uptime (incident 202609), then in status Investigating, about claims of additional vulnerabilities in on-premises N-central 2026.4.1 HF2. That earlier item was no longer listed in the Uptime data feed when we checked at 12 November 2026, 20:33 GMT.
Security researchers, cited by BleepingComputer, say probing for 4EverAble2Shell began at about 08:30 UTC (the same as GMT in November) on 12 November 2026.
The same report says the first attempts to run the complete exploit chain began at 09:16 UTC.
The Hacker News publishes its report, citing security researchers, on 4EverAble2Shell and Agent2Shell. That article predates the later exploitation figures in the BleepingComputer report.
Security researchers, cited by BleepingComputer, say that at 12:50 UTC they found 21 active miners tied to compromised N-central servers.
The Hacker News edited its report. The change, when we previously checked it, was wording only, in the sentence that describes the probing chain.
N-able posted a further Uptime update (incident 202613), November 12 Update: Critical N-central Security Update, status Identified when we checked. The dashboard shows a 16:00 start but does not state a time zone. It says Legacy API access should stay disabled, the Intune integration has been turned off as a precaution, hosted environments have temporary protections, and N-able is developing additional remediation. In that advisory, N-able said it had seen no signs of compromise.
BleepingComputer publishes its report, at 14:51 Eastern Time, citing security researchers, of active exploitation against at least 21 production servers, including 19 on 2026.4.1.26.
We checked N-able's current Uptime update, the BleepingComputer report, The Hacker News, the official CVE and NVD records for CVE-2026-90436, CISA's KEV catalogue 2026.11.10, and the 2026.4 HF2 release notes. Recheck those sources.
What N-able says now
N-able's current Uptime update on 12 November 2026 (incident 202613, status Identified when we checked) says that following additional security disclosures it is restricting certain N-central features and integrations while remediation is completed. It tells on-premises customers to make sure Legacy API access is disabled. Legacy API access is disabled by default; if you enabled it, disable it now, using N-able's how-to article. As a precaution, N-able says it has temporarily deactivated the Intune integration (and that support will contact you if it could not do so). Hosted customers, it says, already have these temporary protections applied and need take no server-side action, but should still upgrade Agents and Probes. On-premises customers should also continue the earlier HF2 guidance, including Agent and Probe upgrades. N-able says it is developing additional remediation. In that same advisory, it said it had seen no signs of compromise and would continue to monitor. That wording was published before the later BleepingComputer report of exploitation.
What BleepingComputer, citing security researchers, reports
The BleepingComputer report, published at 19:51 GMT on 12 November 2026, says 4EverAble2Shell is being exploited against production N-central servers. Researchers reported probing from about 08:30 UTC, and attempts to run the complete chain from 09:16 UTC. At 12:50 UTC they found at least 21 production servers compromised and running XMRig, 19 of them on 2026.4.1.26, the 10 November Hotfix 2 build. The compromised servers were in the United States, Canada, South Africa, the United Kingdom, Germany, France and Sweden. The report describes a chain that uses Apache Axis CVE-2026-90436, then a separate N-central privilege escalation, to get root. We have not independently verified that N-central uses Axis 1.x, and we do not assert that it does beyond what those sources report. We do not describe how the chain is carried out, and we do not link any proof of concept.
The same report describes Agent2Shell as a separate issue that is claimed to allow command execution with SYSTEM privileges on Windows devices. It does not report Agent2Shell being used in the observed 12 November attacks.
Reported indicators
Security researchers, cited by BleepingComputer, report the following. We have not independently confirmed these values in a customer environment. All are written in defanged form and are not links. IP address: 157.20.241[.]16. Requests to /dms/services/ServerUI that reference jline.internal.TerminalLineSettings. A systemd unit named xvd.service. Files or directories at /tmp/.xvd and /var/tmp/.xvd. Mining processes, including XMRig, or unexpectedly high CPU use. The BleepingComputer report also says the miner was configured to use about half of the available CPU cores. Treat hits as leads, not as proof on their own. Pack v1.3.0 hunts these BleepingComputer-reported indicators, plus our own miner, CPU and outbound-peer hunts.
CVE-2026-90436, and why 4EverAble2Shell has no CVE
4EverAble2Shell has no CVE of its own. The only CVE named in the reported chain is CVE-2026-90436, in Apache Axis 1.x, published on 6 November 2026. NVD status was Awaiting Analysis when we checked. The record is marked unsupported when assigned. Apache rates the Axis issue critical and does not expect a fixed 1.x release. CISA's enrichment on NVD gives CVSS 3.1 9.8, Critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That score is for the Axis CVE, not a vendor score for 4EverAble2Shell.
CISA KEV
When we checked at 12 November 2026, 20:33 GMT, CISA's Known Exploited Vulnerabilities catalogue was still version 2026.11.10, released at 19:03 GMT on 10 November 2026, before the 12 November activity. CVE-2026-90436 is not listed. 4EverAble2Shell has no CVE and does not appear in that catalogue either. That catalogue predates this activity. Recheck KEV. We do not treat the absence from KEV as a statement about whether exploitation has occurred. Earlier, separate N-central CVEs are in KEV.
This is not a replacement for Hotfix 2
4EverAble2Shell is separate from the earlier Able2Shell flaws that 2026.4 HF2 was released to address. HF2 remains required for those earlier flaws, but it does not fix 4EverAble2Shell. N-able still expects on-premises customers to be on HF2, build 2026.4.1.26, and all customers, hosted and on-premises, to upgrade Agents and Probes. Our earlier guide is here: N-able N-central Able2Shell zero-days.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Vendor steps and our advice are labelled separately.
Disable the Legacy API, limit exposure, and watch for a fix
- N-able: make sure Legacy API access is disabled on on-premises servers. It is off by default; if you enabled it, disable it now.
- N-able: the Intune integration has been disabled as a precaution. Hosted environments already have temporary protections, and hosted customers need take no server-side action, but should still upgrade Agents and Probes. On-premises customers should also continue the earlier HF2 guidance, including Agent and Probe upgrades.
- N-able (earlier guidance): stay on 2026.4 HF2, build 2026.4.1.26, for the earlier Able2Shell flaws. That hotfix does not fix 4EverAble2Shell.
- Our advice: confirm the Legacy API is off on every on-premises N-central server. Take N-central off direct internet exposure, behind a VPN or an IP allow list, until there is a fixed build. Block 157.20.241[.]16, and watch N-able Uptime for a fix.
Hunt the reported indicators, and treat a hit as a full compromise
- Our advice: look for the indicators reported via BleepingComputer, including 157.20.241[.]16, /dms/services/ServerUI requests that reference jline.internal.TerminalLineSettings, an xvd.service systemd unit, /tmp/.xvd and /var/tmp/.xvd, and mining processes or high CPU.
- Our advice: any hit means a full root compromise of the server. Isolate it, rebuild it, rotate every credential and integration token on that server, and review actions the server pushed to managed devices.
Proactive: Vendor Steps, Then Ours
N-able's steps first, then our advice. There is no patch for 4EverAble2Shell. Hosted customers still need to upgrade Agents and Probes.
Make sure the Legacy API is disabled
N-able's advice, from its 12 November update: make sure Legacy API access is disabled in your on-premises environment. It is disabled by default. If you enabled it, disable it now. The setting is under Administration > Mail and Network Settings > Network Security > LEGACY APIS. N-able links its how-to article for on-premises servers.
Intune is off as a precaution; hosted already have protections
Vendor path: N-able says it has turned off the Intune integration as a precaution while additional protections are implemented and validated. For hosted customers, it says these temporary protections have already been applied, and no server-side action is required. Hosted customers should still upgrade Agents and Probes. On-premises customers should also continue the earlier HF2 guidance, including Agent and Probe upgrades. Watch the current Uptime update for any change.
Stay on Hotfix 2, and keep Agents and Probes upgraded
N-able's earlier guidance, which still applies to the original Able2Shell flaws: on-premises servers should be on 2026.4 HF2, build 2026.4.1.26, and all customers, hosted and on-premises, should upgrade Agents and Probes. HF2 does not fix 4EverAble2Shell. See N-able's HF2 release notes and its 11 November 2026 update. Our earlier guide is here.
Confirm the Legacy API is off, and take N-central off the open internet
Our advice: confirm the Legacy API is off on every on-premises N-central server, not only the one you happen to be logged into. Take N-central off direct internet exposure, behind a VPN or an IP allow list, until there is a fixed build. Block 157.20.241[.]16. Stay on HF2 with Agents and Probes upgraded, for the earlier Able2Shell flaws. Watch the Uptime advisory for a fixed build.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.
check-ncentral.sh
Read-only, offline checker. It reads an inventory CSV (or a single host), and optional saved access logs or audit exports. Since pack v1.3.0, --root (or -Root) is a read-only host-artifact check for the reported xvd.service unit and the .xvd paths, with exit 7 if one is found. --log flags any request to /dms/services/ServerUI, and any line containing jline.internal.TerminalLineSettings; a ServerUI request on its own may be noisy if an integration still uses that API. It never contacts N-central, never writes, and never prints secrets. The CSV header is host,version,internet_exposed, with an optional legacy_api column for the Legacy API state you recorded from the N-central user interface. The checker cannot read that setting itself.
bash check-ncentral.sh --csv inventory.csv --log access.log
# Single host, with the Legacy API state you recorded
bash check-ncentral.sh --host nc01 --exposed yes --version 2026.4.1.26 --legacy-api disabled
# Read-only host-artifact check on the server (or a mounted image)
sudo bash check-ncentral.sh --root /Check-NCentral.ps1
The same checks in PowerShell 7, with identical output and exit codes. It is also read-only and offline, and it never prints secrets.
pwsh -File Check-NCentral.ps1 -Csv inventory.csv -Log access.log
pwsh -File Check-NCentral.ps1 -HostName nc01 -Exposed yes -Version 2026.4.1.26 -LegacyApi disabled
sudo pwsh -File Check-NCentral.ps1 -Root /KQL and Sigma
29 KQL hunts (Q1 to Q1d inventory and exposure; Q2 and Q2b web paths; Q3 audit; Q4 and Q4b server processes; Q5 file writes; Q6 to Q6e managed endpoints for earlier Able2Shell activity from 8 November; Q7 to Q7f, and Q8 to Q8h, from 11 November 2026, 00:00 GMT). The pack now hunts the BleepingComputer-reported indicators (Q7 and Q8 to Q8d, plus Q8g, which is unverified as telemetry), and our own miner, CPU and outbound-peer hunts (Q8e, Q8f and Q8h). 14 Sigma rules, with Kusto conversions included. None of the KQL has been run against a live tenant. The ServerEI hunt (Q7e) is unverified. We do not claim that the Legacy API setting governs /dms/services/ServerUI. Probes are not covered.
Verdicts
- VULNERABLEThe recorded build is below 2026.4.1.26, so the seven HF2 CVEs are unpatched.
- NEW UNPATCHED ISSUESAt 2026.4.1.26 or later, the seven HF2 CVEs are treated as patched, and the new 4EverAble2Shell and Agent2Shell claims are treated as unpatched. The line also reports the Legacy API state you recorded, or asks you to check it.
- OFFLINE/NOT EXPOSEDRecorded as offline, or as not internet exposed, and the build is not confirmed.
- UNKNOWNNothing could be decided from what was scanned.
- LOG REVIEWA saved log or audit pattern matched (this overrides the inventory verdict, and is itself overridden by a host-artifact hit).
- HOST ARTIFACT FOUNDSince pack v1.3.0. The read-only
--rootcheck found anxvd.serviceunit or a/tmp/.xvdor/var/tmp/.xvdpath, indicators reported via BleepingComputer. Treat the server as fully compromised.
Exit codes
| Code | Meaning |
|---|---|
| 0 | OFFLINE/NOT EXPOSED (build not confirmed) |
| 1 | VULNERABLE, exposure with build not confirmed, or Legacy API recorded as enabled |
| 2 | UNKNOWN |
| 3 | PATCHED (HF2 CVEs), Legacy API recorded as disabled; new issues still unpatched |
| 4 | LOG REVIEW |
| 5 | Usage or read error |
| 6 | PATCHED (HF2 CVEs), Legacy API not recorded; check it. New issues still unpatched |
| 7 | HOST ARTIFACT FOUND; overrides every other verdict except a usage error |
The full pack zip contains 61 files: 29 KQL hunts, 14 Sigma rules, both checkers, tests and the README.
Know the limits
- Both checkers are read-only and offline. They never fetch, never write, never contact N-central, and never print secrets.
- None of the KQL has been run against a live tenant. Tune it before relying on it.
- N-able has published no indicators. The NEWS IOC hunts (Q7 and Q8 to Q8d, and Q8g) use indicators reported by BleepingComputer, citing security researchers. Every other hunt is our pattern.
- The ServerEI hunt (Q7e) is unverified. We document N-able's SOAP EI paths, but the link from the LEGACY APIS setting to those paths, and to these claims, is our inference.
- We do not claim that the Legacy API setting governs /dms/services/ServerUI.
- Probes are not covered. The pack does not include verified Probe process names, so Probe hosts are not hunted as Agents are.
- The new-issue hunt window is from 11 November 2026, 00:00 GMT. Earlier hunts for the original Able2Shell activity still start from 8 November.
- On 2026.4.1.26 or later, the checker still reports the new issues as unpatched, and it asks for the Legacy API state you recorded. It cannot read that setting from the server.
- This is pack v1.3.0, in folder n-able-ncentral-4everable2shell-agent2shell-2026-11-pack-v2. The pack now hunts the BleepingComputer-reported indicators, plus our own miner, CPU and outbound-peer hunts. The checker has a read-only --root host-artifact check (exit 7), and --log flags any ServerUI request, which may be noisy if an integration still uses the API. The earlier pack-v1 folder is unchanged and is not used on this draft.
What is in the pack
| File | What it does |
|---|---|
| check-ncentral.sh | Read-only checker for Linux and macOS (bash), including --root and --log |
| Check-NCentral.ps1 | The same checker in PowerShell 7, including -Root and -Log |
| KQL (29 hunts) | Q1 to Q6e inventory, exposure and earlier activity; Q7 to Q7f and Q8 to Q8h, including BleepingComputer-reported indicators and our miner, CPU and outbound-peer hunts |
| Sigma (14 rules) | Indicator and pattern rules, including BleepingComputer-reported indicators; Kusto conversions included |
| tests/ | Fixtures and tests (in the full pack) |
| README.md | Verified facts, N-able vs our advice, limits and usage |
Reactive: How to Hunt (Our Advice)
The hunts below are CybaVerse advice, informed by N-able's advisory and by indicators reported via BleepingComputer and The Hacker News. None of the KQL has been run against a live tenant. The pack now hunts the BleepingComputer-reported indicators, plus our own miner, CPU and outbound-peer hunts. CybaOps can run a hunt across your on-premises N-central servers and managed endpoints.
Hunt the indicators reported on 12 November
Our advice: look for connections from 157.20.241[.]16 (defanged, not a link), requests to /dms/services/ServerUI that reference jline.internal.TerminalLineSettings, a systemd unit named xvd.service, files under /tmp/.xvd or /var/tmp/.xvd, and mining processes or unexpectedly high CPU use, including XMRig. Those indicators come from security researchers, cited by BleepingComputer, not from N-able. Treat hits as leads, not as proof on their own. Pack v1.3.0 hunts those indicators (Q7 and Q8 to Q8d, plus Q8g, which is unverified as telemetry), and our own miner, CPU and outbound-peer hunts (Q8e, Q8f and Q8h), from 11 November 2026, 00:00 GMT. The checker's read-only --root check looks for the reported host artifacts (exit 7), and --log flags any ServerUI request, which may be noisy if an integration still uses the API. None of the KQL has been run against a live tenant. We do not claim that the Legacy API setting governs /dms/services/ServerUI. The ServerEI hunt (Q7e) is unverified, and Probes are not covered.
If you get a hit, treat it as a full root compromise
Our advice: any hit means a full root compromise of the N-central server. Isolate the server, rebuild it, rotate every credential and integration token on that server, and review actions the server pushed to managed devices. Start incident response for every managed client that server could reach. We do not link any proof of concept, and we do not describe how to use one.
If you find signs of compromise (our advice)
- Treat a hit as a full root compromise of the N-central server.
- Isolate the server, then rebuild it.
- Rotate every credential and integration token on that server.
- Review actions the server pushed to managed devices, and start incident response for every managed client it could reach.
N-central 4EverAble2Shell and Agent2Shell FAQ
Short answers based on N-able's 12 November 2026 advisories, a BleepingComputer report, The Hacker News, the official CVE and NVD records for CVE-2026-90436, and CISA's Known Exploited Vulnerabilities catalogue. We checked those sources at 12 November 2026, 20:33 GMT.
What is being exploited?
Security researchers, cited by BleepingComputer, report active exploitation of 4EverAble2Shell against production N-central servers on 12 November 2026, including servers on 2026.4 HF2, build 2026.4.1.26. The report describes a chain that uses Apache Axis CVE-2026-90436 and a separate N-central privilege escalation to get root. 4EverAble2Shell has no CVE of its own. N-able, in its 12 November advisory, said it had seen no signs of compromise; that wording predates the later BleepingComputer report.
What are 4EverAble2Shell and Agent2Shell?
Those names come from public reporting, not from an N-able CVE. The Hacker News, citing security researchers, and the later BleepingComputer report describe 4EverAble2Shell as unauthenticated remote code execution with root privileges on N-central servers, and Agent2Shell as a separate issue that is claimed to allow command execution on managed Windows agents as NT AUTHORITY\SYSTEM. The BleepingComputer report of the 12 November attacks describes exploitation of 4EverAble2Shell. It does not report Agent2Shell being used in that activity. We have not run any proof of concept, and we do not link or describe one.
Does this affect servers already on Hotfix 2?
Yes, according to the researchers cited by BleepingComputer: 19 of at least 21 compromised production servers were running 2026.4.1.26, the 10 November Hotfix 2 build. HF2 remains required for the earlier Able2Shell flaws, but it does not fix 4EverAble2Shell. There is no new patch yet. Disable the Legacy API now, or confirm it is off.
Do the new issues need the Legacy API?
Security researchers, cited by BleepingComputer, say exploitation of 4EverAble2Shell requires the Legacy API to be enabled. N-able tells on-premises customers to make sure Legacy API access is disabled, and says that setting is off by default, without saying the issue depends on it. We do not claim that the Legacy API setting governs /dms/services/ServerUI. N-able has not said whether Agent2Shell needs the Legacy API, and we do not assume that it does.
Is there a CVE, a score, or a patch?
There is no CVE and no vendor score for 4EverAble2Shell itself, and N-able has not released a fix for it. Critical by impact is our framing, not a vendor score. The Axis issue in the reported chain, CVE-2026-90436, is rated Critical, CVSS 3.1 9.8, by CISA's enrichment on NVD, and is marked unsupported when assigned. The mitigation N-able gives now is to keep the Legacy API disabled, keep Intune off as a precaution, and continue upgrading Agents and Probes. Watch Uptime for a fixed build.
Are these issues in CISA KEV?
When we checked at 12 November 2026, 20:33 GMT, CISA's Known Exploited Vulnerabilities catalogue was still version 2026.11.10, released at 19:03 GMT on 10 November 2026. CVE-2026-90436 is not listed. 4EverAble2Shell has no CVE and does not appear in that catalogue. That catalogue predates the 12 November activity. Recheck KEV. We do not treat the absence from KEV as a statement about whether exploitation has occurred. Earlier, separate N-central CVEs are in KEV.
What should we look for?
Our advice: look for 157.20.241[.]16, requests to /dms/services/ServerUI that reference jline.internal.TerminalLineSettings, an xvd.service systemd unit, /tmp/.xvd and /var/tmp/.xvd, and mining processes or high CPU. Those indicators were reported by security researchers, cited by BleepingComputer. Any hit means a full root compromise.
What should we do first?
Follow N-able first: make sure the Legacy API is disabled on on-premises servers, keep the Intune integration off as a precaution, and continue upgrading Agents and Probes. Hosted customers need take no server-side action, N-able says, but should still upgrade Agents and Probes. Our advice on top: confirm every on-premises server, take N-central off direct internet exposure, block 157.20.241[.]16, and watch for a fixed build. If you find signs of compromise, isolate the server, rebuild it, rotate every credential and integration token, and review actions the server pushed to managed devices.
How does this relate to Able2Shell?
4EverAble2Shell was disclosed after N-able released 2026.4 HF2 for the earlier Able2Shell flaws. HF2 is still required for those earlier flaws, but it does not fix 4EverAble2Shell. Our guide to that earlier disclosure is N-able N-central Able2Shell zero-days.
What is CVE-2026-90436?
It is a flaw in Apache Axis 1.x, published on 6 November 2026. Apache Axis 1.x is end of life, and Apache does not expect a fixed 1.x release. Apache rates it critical. CISA's enrichment on NVD gives CVSS 3.1 9.8, Critical. The record is marked unsupported when assigned. Security researchers, cited by BleepingComputer, describe it in the 4EverAble2Shell attack chain. We have not independently verified that N-central uses Apache Axis 1.x, and we do not assert that it does beyond what those sources report.
Who is this relevant to?
Anyone who runs on-premises N-able N-central, especially if the Legacy API is, or was, enabled and the server is reachable from the internet, and anyone who manages endpoints from those servers. N-able says hosted customers already have temporary protections and need take no server-side action, but should still upgrade Agents and Probes.
Need help checking every on-premises N-central server?
CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- N-able Uptime: N-central Critical Security Incident - 2026.4.1 HF2 Release (incident 202609, started 07:00 GMT on 12 November 2026; that earlier item was no longer listed in the Uptime data feed when we checked at 12 November 2026, 20:33 GMT)
- N-able Uptime: November 12 Update, Critical N-central Security Update (incident 202613, N-able update on 12 November 2026, status Identified when checked at 12 November 2026, 20:33 GMT; the dashboard start time does not state a time zone)
- N-able: How to Disable Legacy API settings on On-premise N-central servers
- N-able Status: N-central 2026.4 HF2 release notes (posted and last updated 10 November 2026; re-checked at 12 November 2026, 20:33 GMT)
- N-able: Update on N-central 2026.4 HF2 and ongoing security response (11 November 2026)
- BleepingComputer: New N-able "4EverAble2Shell" zero-day exploited hours after PoC released (published 19:51 GMT on 12 November 2026, 14:51 Eastern Time; checked at 12 November 2026, 20:33 GMT)
- The Hacker News: New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access (published 12 November 2026, 11:51 GMT; edited 13:11 GMT the same day, wording only)
- CVE Programme: CVE-2026-90436, Apache Axis 1.x, published 6 November 2026. Apache rates it critical. There is no fixed Axis 1.x release. The issue is marked unsupported when assigned (re-checked at 12 November 2026, 20:33 GMT)
- NVD: CVE-2026-90436 (published 16:18 GMT on 6 November 2026; last modified 17:06 GMT on 12 November 2026; status Awaiting Analysis when checked at 12 November 2026, 20:33 GMT; CISA enrichment on NVD gives CVSS 3.1 9.8, Critical)
- CISA: Known Exploited Vulnerabilities catalogue (catalogue 2026.11.10, released 19:03 GMT on 10 November 2026; checked at 12 November 2026, 20:33 GMT)
Our earlier guide to the original Able2Shell flaws and Hotfix 2 is at N-able N-central Able2Shell zero-days. All threat guides.