Independent security researcher Sean Bales has disclosed two new sets of vulnerabilities affecting N-able N-central, which are being actively exploited by threat actors in the wild. According to reports, attackers are leveraging these flaws to compromise servers and deploy malicious payloads. The exploitation campaign has successfully infected multiple environments, prompting urgent attention from security teams and the vendor alike.

The newly disclosed security issues are tracked under the names 4EverAble2Shell and Agent2Shell. These vulnerabilities involve complex attack chains that target server infrastructure. Security analysts have observed that malicious actors are actively taking advantage of these weaknesses to bypass standard defenses, gaining unauthorized entry into targeted systems to execute their commands.

Specifically, the exploit chain combines a critical Apache Axis vulnerability, designated as CVE-2026-90436 with a CVSS score of 9.8, alongside an N-central privilege escalation weakness. Cybersecurity firm Huntback observed infections across 21 N-central servers. Notably, this total included 19 servers that were already running Hotfix 2, demonstrating that previous patching levels were insufficient to block the sophisticated attack chain on their own.

During the observed intrusions, threat actors utilized an attacker-controlled server at the IP address 157.20.241.16 to download and execute a shell script. This script was designed to deploy an XMRig Monero cryptocurrency miner onto the compromised machines. Following the researcher disclosures, N-able restricted certain N-central features and integrations as an additional precaution while investigations continued.

This active exploitation campaign presents significant risks to organisations relying on the affected software, as cryptocurrency mining malware can drain system resources and indicate a deeper intrusion. Because threat actors are actively combining remote execution flaws with privilege escalation, any compromised host should be treated as a full system compromise rather than a routine malware cleanup job.

To mitigate these risks, security professionals recommend that administrators upgrade Agents and Probes on N-central version 2026.4 HF1 and above. Furthermore, on-premises customers must ensure that Legacy API access is disabled if it was previously enabled. Applying these recommended defensive steps and monitoring infrastructure for unauthorised script execution will help organisations protect their networks against ongoing exploitation attempts.

Stay alert, and keep your security measures updated!

Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news