[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f349EqQMqqAX4Szu5nJ2kHI1nWhuuZGVCiDTp_8kMj_E":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"795dc191-d0e1-41d1-a617-e104d351b903","New N-able \"4EverAble2Shell\" zero-day exploited hours after PoC released","new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released-7f23aa","Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed \"4EverAble2Shell\" to compromise servers and deploy cryptocurrency miners, with researchers reporting at least 21 affected systems, including 19 running the company's latest security update. [...]","Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability, dubbed '4EverAble2Shell', to compromise servers and deploy cryptocurrency miners. Researchers have identified at least 21 affected systems, with 19 running the latest security update. The attacks follow the release of proof-of-concept exploits for '4EverAble2Shell' and 'Agent2Shell', which grant attackers root-level access to N-central appliances and SYSTEM-level access to Windows systems.","N-able N-central zero-day '4EverAble2Shell' exploited hours after PoC release.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F08\u002F18\u002FN-able.jpg","2026-11-12T19:51:16+00:00","2026-11-12T20:00:07.387436+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"N-central","product",{"name":21,"type":22},"N-able","vendor",{"name":24,"type":25},"remote monitoring and management (RMM)","technology",{"name":27,"type":25},"Legacy API",{"name":29,"type":25},"Apache Axis","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":30,"icon":32,"name":33,"slug":34},null,"Zero-day","zero-day",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"cve","CVE-2026-90436","Apache Axis vulnerability combined with N-central privilege escalation weakness.",[21,18],{"controls":60,"vendors":148},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":159},"zero-day-in-n-able-n-central-exploited-within-hours-of-poc-release","Zero-Day in N-able N-central Exploited Within Hours of PoC Release","The '4EverAble2Shell' vulnerability in N-able N-central allowed attackers to gain root-level access to management appliances and deploy cryptocurrency miners within hours of a public proof-of-concept being released — and 19 of the 21 compromised systems were already running the latest security update, confirming this was a true zero-day exploitation window. This incident highlights how rapidly threat actors operationalize published exploits, compressing the time defenders have to react. Remote management platforms like N-central are especially high-value targets because compromising them can cascade into control over all managed endpoints. Organizations must have emergency response playbooks specifically for critical infrastructure tools, and must monitor for active exploitation signals even before patches are available.",[154,155,156,157,158],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 12: Network Infrastructure Management (v8)","NIST SP 800-53 SI-5: Security Alerts, Advisories, and Directives","MITRE ATT&CK T1190: Exploit Public-Facing Application","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":160,"MITRE ATT&CK T1190: Exploit Public-Facing Application":161,"CIS Control 12: Network Infrastructure Management (v8)":162,"CIS Control 7: Continuous Vulnerability Management (v8)":163,"NIST SP 800-53 SI-5: Security Alerts, Advisories, and Directives":164},"NIS2 Article 21(2)(e) mandates vulnerability handling and disclosure practices, requiring operators to have processes for rapidly responding when vulnerabilities in critical management tools are publicly exploited.","Attackers exploited a publicly disclosed PoC against an internet-facing N-central appliance to gain initial root-level access, which is precisely what T1190 describes.","CIS Control 12 calls for securing and limiting exposure of network management infrastructure, which would have reduced the attack surface for internet-facing N-central appliances.","CIS Control 7 requires continuous scanning and prioritized remediation of vulnerabilities, including tracking newly disclosed zero-days in actively used software like N-central.","SI-5 requires organizations to receive and act on security alerts from vendors and external sources, which is critical when a PoC is released and active exploitation begins within hours."]