It started, as these things usually do, with a quiet Monday. An IT administrator at a managed service provider opened her laptop, checked the overnight alerts, and found nothing alarming. Her clients’ servers were up, the backups had run, and the coffee was still warm.
By lunchtime, the company that makes the software she uses to watch over all those machines had pulled its own cloud offline. Within three days, a second wave of exploits had slipped past the emergency patch — and at least 21 servers were quietly mining cryptocurrency for strangers.
This is the story of the N-able N-central zero-day, one of the messiest security incidents of the year — and a warning about what happens when the tools that guard everyone else’s computers become the target.
The N-able N-Central Zero-Day: 33 Flaws in One Dump
On November 9, 2026, independent security researcher Sean Bales published a set of 33 vulnerabilities in N-able’s N-central platform, complete with working proof-of-concept exploits. He called the collection Able2Shell.
N-central is remote monitoring and management software — the kind of tool that managed service providers use to watch over hundreds or thousands of client computers from a single dashboard. It can install updates, run scripts, and reach deep into the machines it manages.
That reach is exactly what makes it such a tempting target. The flaws Bales found included credential disclosure, arbitrary file writes, directory traversal, cross-site scripting, XML external entity injection, and remote code execution. Chained together, they formed at least four working attack paths: three leading to remote code execution and one to full root privilege escalation.
The most alarming chain needed no login at all. According to Tenable’s analysis of the disclosure, an unauthenticated attacker could hijack a trusted session, reset account credentials, and create a rogue administrator account with full control of the server.
Bales tested his exploits against N-central Appliance version 2026.4.0.31. Security firm Huntress warned that earlier versions were likely affected too. The proof-of-concept code was published openly on GitHub, free for anyone — defender or attacker — to download.
N-able Takes Its Own Cloud Offline
Within hours of the disclosure, the company took its hosted N-central environments offline across the Americas, Europe, and Asia-Pacific as a precaution.
Customers running N-central on their own servers were told to take them offline too, and to keep them down until the company said it was safe to bring them back. For managed service providers, that meant losing the very tool they use to keep their clients running.
At 15:15 UTC on November 9, N-able said it had seen no active exploitation. But researchers watching the internet told a different story. WatchTowr reported exploitation attempts against its N-central honeypots overnight, and other firms logged scanning activity built around the published proof-of-concept code.
The race was on. Every hour the flaws stayed unpatched was an hour in which anyone with an internet connection could try the public exploits against any exposed N-central server.
Hotfix 2 Lands — Then the Second Wave Hits
On November 10, N-able released N-central 2026.4 Hotfix 2, build 2026.4.1.26. The update fixed seven CVEs, and the company urged customers to install it immediately. For a day, it looked like the worst might be over.
It was not. Early on November 12, Bales published two more exploit sets: 4EverAble2Shell and Agent2Shell. He said both worked against the freshly patched Hotfix 2 build.
The first chain, 4EverAble2Shell, combines a critical flaw in the ageing Apache Axis 1.x software engine — CVE-2026-90436, rated 9.8 out of 10 — with a privilege escalation bug inside N-central itself. Together, they give an unauthenticated attacker root access to the server.
There is one important condition. The attack only works where N-central’s Legacy API is switched on and reachable from the internet. That setting is off by default, and N-able does not recommend enabling it. But plenty of older deployments still have it turned on.
The second set, Agent2Shell, raises the stakes further. It targets the managed Windows endpoints that N-central looks after, offering system-level command execution on the computers of ordinary businesses. No exploitation of Agent2Shell has been reported so far — but the code is public.
21 Servers Mining Monero Before Noon
The gap between disclosure and exploitation was measured in hours, not days. Security firms Previdian and Huntback recorded probing against their decoy systems from around 08:30 UTC on November 12, with full attack attempts starting at 09:16 UTC.
By the end of the day, Huntback had found at least 21 production N-central servers running Monero cryptocurrency miners. Nineteen of them were already running Hotfix 2 — the very update meant to stop the attacks.
The only payload seen so far is the XMRig miner. That is, in a grim sense, good news. The attackers chose quiet profit over destruction. But a server that can be forced to mine cryptocurrency can just as easily be forced to steal data, deploy ransomware, or open a door into every client network it manages.
N-able’s own November 12 update struck a different note, saying it had seen no signs of compromise. The gap between the vendor’s statement and the researchers’ findings is now part of the story — and a reminder that absence of evidence is not evidence of absence.
On November 13, N-able said it had identified additional indicators of compromise and was working directly with affected customers. The incident was still unfolding.
What N-able Is Telling Customers to Do Now
With no build yet available that fully fixes the new chains, N-able’s advice is blunt: confirm the Legacy API is disabled, and keep it that way. The company has also disabled its Intune integration and restricted other N-central features while it works on further fixes.
Customers are also being told to upgrade their Agents and Probes — the small programs installed on managed machines — and to hunt for signs of compromise on their servers.
Researchers have published a checklist of things to look for: requests to the server’s /dms/services/ServerUI endpoint referencing an unusual Java class, an unexpected systemd service called xvd.service, files hidden under /tmp/.xvd or /var/tmp/.xvd, XMRig processes running where they should not be, and network traffic to the address 157.20.241.16.
The guidance is stark. Any single hit on that list should be treated as a full root compromise of the server — not a warning sign, but a confirmed break-in.
As of November 13, the flaws had not been added to CISA’s Known Exploited Vulnerabilities catalogue. That is likely a matter of time rather than doubt.
Why This One Stings More Than Most
Security incidents involving remote management tools carry a special kind of dread. N-central is not a single company’s server. It is the control panel for thousands of businesses that trust their IT provider to keep them safe.
When a tool like that is compromised, the blast radius is not one network but hundreds. An attacker who owns an MSP’s N-central server can, in principle, reach every client that MSP serves. It is the same nightmare logic that made the SolarWinds and Kaseya incidents so damaging.
The timing made it worse. The flaws arrived in public, with working exploits, before any patch existed. The hotfix that followed covered only seven of the 33 reported issues, and the researcher then showed the patch itself could be bypassed.
It is also a story about old software. The first stage of the new attack chain runs through Apache Axis 1.x, a software engine that reached the end of its life years ago yet still sits inside products that businesses depend on every day.
The pattern will be familiar to anyone who has followed security news this autumn. The Microsoft November Patch Tuesday update fixed more than a thousand flaws, including an Outlook zero-day already under attack. The Fireworks AI breach and the Railway breach both showed how quickly stolen credentials turn into real damage. N-central fits the same mould — except here, the attackers were handed the keys in public.
What Happens Next
N-able is still building a fix for the new exploit chains, and has not said when it will arrive. Until then, the only reliable defence is the one the company keeps repeating: Legacy API off, servers patched, agents updated, logs checked.
For the managed service providers caught in the middle, the week has been a brutal lesson in supply-chain risk. Their clients hired them to remove exactly this kind of worry. Instead, the tool they bought to protect their clients became the thing that needed protecting.
The wider lesson is simpler, and it applies far beyond N-central. When a researcher publishes 33 flaws with working exploits, the clock does not start when the patch ships. It starts the moment the code goes public — and, as 21 mining servers proved this week, the attackers are watching that clock too.
