Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed "4EverAble2Shell" just hours after security researcher Sean Bales released a proof-of-concept on November 12. The exploit combines Apache Axis CVE-2026-90436 with a separate N-central privilege escalation flaw to execute commands as root on vulnerable servers, but it requires the platform's Legacy API to be enabled. Researchers from Previdian and Huntback have observed probing and successful exploitation of at least 21 production N-central servers, installing XMRig Monero miners that use roughly half the CPU cores. N-able responded by disabling the Intune integration, restricting certain features, and urging on-premises customers to ensure Legacy API access is disabled while additional fixes are developed. 1