Major Flaws in N-central Let Hackers Deploy Miners on Servers Running Latest Hotfix

N-able's N-central remote monitoring software is under active attack. Newly disclosed vulnerabilities, tracked as 4EverAble2Shell and Agent2Shell, allow attackers to execute arbitrary code and gain SYSTEM-level access to managed Windows servers. This exploit chain combines a critical Apache Axis flaw (CVE-2026-90436) with a privilege escalation weakness in N-central. Despite many victims already running the latest hotfix, threat actors are successfully deploying cryptocurrency miners on compromised systems.

The company is scrambling to respond, disabling legacy APIs and certain integrations like Intune in its hosted environments. For both on-premises and hosted customers, the urgent directive is to upgrade all Agents and Probes to version 2026.4 HF1 or higher. The takeaway is stark: a widely used enterprise IT management tool has become a gateway for attacks, and even patched systems are not fully safe until the entire communication chain is updated.

What to do: Upgrade Agents and Probes to N-central version 2026.4 HF1 or above and ensure Legacy API access is disabled.