CVE
CVE-2026-90436
Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName
Exploitation IoCs 6
Domain dms/services/ServerUI
Filename /tmp/.xvd
Filename /var/tmp/.xvd
Filename jline.internal.TerminalLineSettings
Filename xvd.service
IP 157[.]20[.]241[.]16
MITRE ATT&CK TTPs 11
T1059.001 T1059.004 T1068 T1071.001 T1082 T1095 T1134 T1190 T1484.001 T1543.002 T1570
PowerShell
Execution
Unix Shell
Execution
Exploitation for Privilege Escalation
Privilege Escalation
Web Protocols
Command And Control
System Information Discovery
Discovery
Non-Application Layer Protocol
Command And Control
Access Token Manipulation
Defense Evasion
Exploit Public-Facing Application
Initial Access
Group Policy Modification
Defense Evasion
Systemd Service
Persistence
Lateral Tool Transfer
Lateral Movement
Source Articles
New N-central Exploits Work Against Patched Servers, Enable Root RCE and Windows SYSTEM Access
New exploits named 4EverAble2Shell and Agent2Shell have been disclosed against N-central on-premise servers, enabling unauthenticated remote code execution with root privileges and command execution as SYSTEM on Windows agents, respectively. These vulnerabilities affect patched versions, including build 2026.4.1.26, and rely on the non-default Legacy API being enabled. Probing activity has been observed from IP 157.20.241[.]16, leveraging the Apache Axis flaw CVE-2026-90436 for initial access, followed by attempts to exploit 4EverAble2Shell and download a malicious shell script.
hacker-news Nov 12, 2026
New N-able "4EverAble2Shell" zero-day exploited hours after PoC released
Hackers are actively exploiting a newly disclosed zero-day vulnerability in N-able N-central, dubbed '4EverAble2Shell', to gain root access to servers and deploy cryptocurrency miners. The exploit chain combines CVE-2026-90436 in Apache Axis with a privilege escalation flaw in N-central, allowing unauthenticated attackers to execute commands as root. Security firms Previdian and Huntback confirmed exploitation in the wild, with at least 21 production servers compromised, including those running the latest security update. Attackers are downloading Monero miners via shell scripts from a known malicious IP, using stealthy techniques to avoid detection.
bleeping-computer Nov 12, 2026