4EverAble2Shell is being exploited: XMRig miners on 21 production N-central servers, 19 of them already on the Nov 10 Hotfix 2
- Do now: make sure Legacy API is disabled on on-prem N-central (N-able's advisory says the server chain needs it on and exposed); HF2 alone did not protect these 19 servers.
- Treat a hit as full compromise: the operator ran a tested root escalation with a live callback channel on a host that manages your customers' endpoints. The miner is the only payload seen so far, but huntback says to handle it as a full compromise, not a cleanup job.
- Where: victims in the US (9), South Africa (4), Canada (4) and one each in the UK, Germany, France and Sweden, across Azure, AWS, OVH, regional carriers and MSPs. huntback isn't publishing the addresses.
- Still open: no N-able fix or CVE for 4EverAble2Shell yet; Huntress said earlier today it had not seen exploitation in its partners' environments. Indicators are in the hunt item.
Sources: huntback: 4EverAble2Shell is already mining Monero on live N-central servers (Nov 12, 2026) · Huntress: N-able Disables Cloud Services Following Disclosure of Able2Shell Exploit Chains (updated Nov 12, 6:30 AM ET) · BleepingComputer: New N-able "4EverAble2Shell" zero-day exploited hours after PoC released (Nov 12, 2026)