N-central Exploit Chain Struck Within Five Hours of PoC Release - and Works on Servers Patched Two Days Earlier

N-able's N-central platform is under active attack via a chain dubbed 4EverAble2Shell, published on GitHub on 12 November. The chain exploits CVE-2026-90436 - a CVSS 9.8 flaw in the long-obsolete Apache Axis 1.x library quietly bundled inside N-central - to gain remote code execution, then escalates to root through a helper script. Critically, it works against servers running Hotfix 2 (2026.4.1.26) that N-able shipped on 10 November, and requires only a non-default configuration: the Legacy API enabled and exposed to the internet. Security firm Huntback confirmed 21 mining rigs running in production servers, about five hours after the proof of concept went public.

The incident compresses three lessons into one week. Public proof-of-concept to in-the-wild exploitation is now measured in hours, not days. Recent patches are not a safety guarantee - Tuesday's hotfix acted as a target map by Friday. And legacy components silently bundled inside modern software, such as EOL Java SOAP libraries, rarely appear in software bills of materials. As of 13 November no full patch exists; the primary mitigation is disabling the Legacy API and hunting for artifacts like /tmp/.xvd and xvd.service.