As reported by The Hacker News, independent security researcher Sean Bales has disclosed two exploit chains — 4EverAble2Shell and Agent2Shell — targeting N-able N-central, a widely deployed remote monitoring and management (RMM) platform. The disclosure arrives alongside confirmed active exploitation: 21 servers infected, 19 of which were running Hotfix 2, and cryptocurrency miners deployed as the payload.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE | CVE-2026-90436 |
| CVSS | 9.8 (Critical) |
| Affected Product | N-able N-central (all recent versions, including 2026.4 HF1) |
| Vendor | N-able (formerly SolarWinds MSP) |
| Root Cause | Unsafe class instantiation during SOAP fault processing in bundled Apache Axis component, chained with a privilege escalation weakness |
| Impact | Unauthenticated RCE as root (Linux) / SYSTEM (Windows); lateral movement via Agent/Probe communication |
| Active Exploitation | Yes — 21 servers compromised, crypto miners deployed |
| Mitigation | N-central 2026.4 HF1+ with Legacy API disabled; Agent and Probe upgrades |
Why This Matters
The fact that 19 of 21 compromised servers were already running Hotfix 2 is the most alarming detail in this disclosure. It signals that the patch path alone does not neutralize the attack surface — the Legacy API remains the persistent entry vector. N-able's decision to forcibly disable the Legacy API and Intune integration in hosted environments confirms this assessment.
RMM platforms are high-value targets because they sit at the trust boundary between MSPs and their downstream customers. A single compromised N-central instance can cascade into thousands of managed endpoints. This is the same dynamic that made the Kaseya VSA attack in 2021 so devastating, and it underscores why RMM infrastructure must be treated as tier-0 critical asset — not just another management tool.
The Apache Axis component is also notable. Legacy Java deserialization and unsafe class instantiation flaws in bundled SOAP stacks have been a recurring attack vector for over a decade. Organizations should audit whether their critical infrastructure vendors are shipping outdated, end-of-life Java libraries in production software.
Who Is at Risk
Shield53 Recommendations
Immediate Actions
- Disable Legacy API immediately on all on-premises N-central instances. This is the single most impactful mitigation. Verify via N-central administration console that the Legacy API toggle is off.
- Upgrade all Agents and Probes to N-central 2026.4 HF1 or later. Partial upgrades leave communication gaps — both sides must be patched for the new Probe/Agent protocol.
- Audit for indicators of compromise: look for unexpected cryptocurrency mining processes, unfamiliar cron jobs or scheduled tasks, and new outbound connections to mining pool IPs. Common miners seen in RMM compromises include xmrig variants.
- Restrict network exposure: ensure the N-central server is not internet-facing. The Apache Axis SOAP endpoint should never be reachable from untrusted networks. Use a VPN or zero-trust access layer.
- Review N-central service account permissions. If the platform runs as root or SYSTEM by default, consider least-privilege service account configurations where possible.
Strategic Actions
- Treat RMM consoles as tier-0 infrastructure. Apply the same hardening, monitoring, and access controls you would for domain controllers or identity providers.
- Inventory all third-party bundled components in critical software. Demand SBOMs from vendors and flag EOL Java libraries like Apache Axis.
- Deploy EDR on RMM servers — not just managed endpoints. Behavioral detection should catch post-exploitation activity like process injection and unusual child processes from web services.
The 19-of-21 hotfix infection rate is a clear warning: applying a vendor hotfix without disabling the underlying attack surface is not remediation. Defense-in-depth means closing the vector, not just patching the code.
