Threat Actors Infect 21 N-central Servers With Monero Miner, 19 on Hotfix 2

Cryptomining threat actors have compromised 21 N-able N-central servers using an unauthenticated exploit chain called 4EverAble2Shell, disclosed alongside Agent2Shell, and 19 infected systems were running Hotfix 2, described as the latest hotfix, according to threat intelligence reporting. The attacks deployed XMRig Monero miners and used a script pulled from 157.20.241[.]16. N-able said it is restricting features, including turning off Legacy API by default in hosted environments and disabling Intune integration while it completes remediation.

The chain combines CVE-2026-90436, a 9.8-rated Apache Axis flaw, with an N-central privilege escalation weakness that can yield root access and SYSTEM-level access on Windows under specific conditions. Previdian, tracking it as VULN-2026-0009, said unsafe class instantiation during SOAP fault processing lets a crafted request run commands as the nable service account. Huntback said the same IP deployed the miner on 21 servers, using half the CPU cores to reduce detection. The affected servers were reported across the U.S., South Africa, Canada, the U.K., Germany, France and Sweden.

The hotfix detail matters because N-central is a remote management platform used by IT providers to monitor and control customer endpoints. A root-level foothold on such a server is not just a miner infection; it can become a bridge to downstream devices. N-able's response, including disabling Legacy API and Intune integration, suggests that configuration surface and bundled components are part of the exposure. The vendor recommends upgrading Agents and Probes on version 2026.4 HF1 and above; independent researcher Sean Bales disclosed the flaws.

For managed service providers and business owners, the incident turns patching from a checkbox into a risk-management problem. If 19 compromised servers were already on the latest hotfix, administrators cannot assume the newest update alone removes the attack path. They must also upgrade Agents and Probes together, disable legacy access where enabled, and treat any confirmed hit as a full compromise of a system that can reach customer endpoints. The source does not identify a state actor or broader campaign.