A new zero-day vulnerability has been exploited just hours after a proof-of-concept (PoC) exploit code was published online. The flaw, dubbed 4EverAble2Shell, affects N-able N-central servers and allows unauthenticated attackers to gain remote code execution (RCE) with root privileges.
This is particularly concerning because the vulnerability was made public by security researcher Sean Bales just two days after N-able rolled out fixes for several other unpatched flaws. Bales exploited a recent Apache Axis vulnerability, chaining it with an unspecified security hole in N-central deployments that have Legacy API enabled. This exploit chain targets the Axis bug to achieve RCE and then attempts to elevate privileges to root and run a shell script.
The fact that threat actors started using the 4EverAble2Shell PoC in attacks just hours after it landed is a stark reminder of how quickly zero-day vulnerabilities can be exploited in real-world scenarios. According to early-warning threat intelligence platform Previdian, WatchTowr Intel saw probes for ‘4EverAble2Shell’ affecting builds with Legacy API enabled.
N-able reacted swiftly by restricting certain features and integrations, including Legacy API and Intune integration. The company is working closely with affected customers to assess and mitigate any potential risks. “Through our ongoing investigation today, we have identified additional indicators of compromise (IoCs) and are working closely with those specific customers to assess and mitigate any potential risks,” N-able said in a statement.
Interestingly, some of the compromised servers had applied the latest patches from N-able, highlighting that patching alone is not enough. Huntback notes that 19 of the victims had applied the latest patches, but were still vulnerable to exploitation. “The miner is the only payload we have seen, but the escalation hands the operator root on a host that manages your customers’ endpoints,” they warn.
This incident serves as a stark reminder of the importance of staying vigilant and up-to-date with security patches and fixes. It also highlights the need for organizations to implement robust monitoring and detection systems to quickly identify and respond to potential threats. As Lupovis notes, “Each victim’s miner is named after its IP address,” making it clear that attackers are leaving a trail that can be easily followed.
In light of this incident, we urge organizations using N-central servers to take immediate action by reviewing their configurations and ensuring that Legacy API is disabled. Additionally, they should implement robust monitoring and detection systems to quickly identify any potential threats.
Source: SecurityWeek — 2026-11-13