Huntback says 21 N-central servers mine Monero after a public exploit, 19 of them on Hotfix 2

8 hours 52 minutes from a public exploit to 21 listed mining rigs

Huntback says a proof of concept for N-able N-central was added to a public repository at 03:58 UTC on 12 November 2026, that its first check reached a decoy at 08:30, its first full chain at 09:16, and that at 12:50 UTC a public mining pool listed 21 rigs named for N-central servers. From 03:58 to 12:50 is 8 hours 52 minutes (derived). Nineteen of the 21 report build 2026.4.1.26, which Huntback says is N-central 2026.4 Hotfix 2, released on 10 November: 90.5 percent (derived). Read at 20:07 UTC on Thursday 12 November 2026.

What that does not establish. It does not say how servers on the patched build were reachable by the chain, because Huntback does not say whether any of the 21 had the Legacy API enabled, and the researcher, as BleepingComputer relays him, says the exploit needs it, while BleepingComputer reports the default as off. It does not say what the operator did beyond installing a miner, who the operator is, how many N-central servers are exposed, whether Huntback's 21 is complete, or whether the second exploit published the same day, Agent2Shell, has been used. This briefing could read Huntback's page but not the pool, the decoys' logs or the addresses.

One interest each, stated once. Huntback sells deception and decoy products and offers a free alert on N-central exploitation on the same page. Previdian, whose vulnerability page is read below, sells an exploitation feed and a Pro plan. N-able sells N-central. Tenable, whose FAQ is cited for context, sells vulnerability management. This briefing follows an earlier one on the 33 alleged N-central flaws, whose original title said no exploitation had been seen; that statement was N-able's reading at 15:15 UTC on 9 November and it concerned that set of flaws, not these.

What happened, in the order Huntback gives it

Earlier in the week a researcher published working exploits for more than thirty N-central flaws, and N-able shipped Hotfix 2 on 10 November (Huntback; N-able's release notes, posted 10 November, give build 2026.4.1.26). On 12 November two more exploits followed, named 4EverAble2Shell and Agent2Shell. Huntback writes that public reporting says 4EverAble2Shell gives unauthenticated remote code execution as root and works against Hotfix 2 when the Legacy API is enabled. This briefing did not open the repository, which is reported to hold working exploit code, and it does not name the researcher.

Zoom

08:30 UTC. Huntback says a single source address sent its first 4EverAble2Shell check to Huntback's N-central decoys, using a browser style user agent. A second round of checks came at 08:59 to 09:00. 09:16. The same source sent what Huntback calls the weaponised request, now with a scripting library user agent. In plain words, per Huntback, the request had three stages: code execution as the account the N-central web stack runs under, a local escalation to root using the platform's own maintenance tooling, and a root command that fetches and runs a miner installer. A callback channel back to the operator reported that the escalation had worked and that traces were cleaned up. This briefing gives no class names, helper names, commands or sequence beyond that.

The same payload arrived again at 09:36, 10:03 and 10:05, each with its own callback port between 19202 and 19418, so four weaponised requests between 09:16 and 10:05 (derived count; 49 minutes from first to last, derived). A last check at 10:09 repeated the probe body from 08:30. Huntback says its decoys never run commands, so no miner started on them, and the labels the operator assigned to the decoys do not appear on the pool. Every rig listed there, it says, is a real server that ran the chain to the end.

The installer, Huntback says, names every infected host nc_ followed by the victim's own address, and mines into a public pool that publishes per rig statistics. That naming is what made the count possible. Huntback adds that the miner uses about half the CPU cores, which BleepingComputer reads as likely to make mining harder to detect (BleepingComputer's inference, not a measurement). The installer checks in with the operator twice over HTTP and persists through a watchdog; the indicators for all of this are in Technical details.

The clock as arithmetic

Every interval below is this site's arithmetic on timestamps Huntback prints, except the last, which is a calendar count. Huntback's own prose says the first weaponised request came forty-five minutes after the first check; its two timestamps are 46 minutes apart (derived). That is a one minute rounding in the source, kept as printed.

The 21 servers: how Huntback matched pool names to N-central

The method, as Huntback describes it: the operator's installer labels each rig with the victim's address, so a pool page that lists rig names is a list of addresses. Huntback says it then checked each address with a few ordinary HTTPS requests and found that all 21 serve N-central's root page, 20 serve the login page (most with the managed service provider's own branding, behind certificates issued months earlier), and the last restricts its login page but presents a certificate for an IT services company. It concludes these are production servers, not sandboxes or decoys. It does not publish the addresses.

What that does and does not prove. It shows that 21 pool rig names correspond to addresses answering with an N-central page, and that each rig had submitted a valid share in the five minutes to 12:50 UTC. It does not show that each server was compromised by 4EverAble2Shell: the link from rig name to chain rests on the installer's naming convention and on the decoys' sightings of the same source address and payload, and this briefing could not see the pool or any victim. Huntback also does not say how it read the build numbers, nor what the decoys presented as their own build.

Zoom

The builds. Huntback says 19 report 2026.4.1.26 and one runs 2025.3.1.9. That is 20; no build is stated for the other one (derived: 21 minus 19 minus 1). The 2025.3.1.9 server is not on Hotfix 2, so the cleanest reading of Huntback's headline is that 19 patched servers were compromised, not 21. The places. United States 9, South Africa 4, Canada 4, and one each in the United Kingdom, Germany, France and Sweden: 21 (derived sum), spread across cloud providers, regional carriers and managed service providers, with three in one provider's address block. A single UK server is a location, not a UK victim this briefing can name, and no UK source is involved, so there is no UK section.

The rest of the wallet. The same wallet listed 631 rig names at 12:50 UTC, about 255 kH/s in all. Huntback prints prefixes for Jpom (39), FreePBX (12), MLflow (10), Apache Flink (5), PaperCut (2), SFTPGo (2) and AJ-Report (2), plus nc_ (21), which is 93 rig names (derived), and more than 170 named by address and port 3000. So more than 263 names are described and fewer than 368 are not (derived). The 21 N-central rigs are 3.3 percent of the names but, at about 25 of about 255 kH/s, about 9.8 percent of the rate (derived from rounded figures): about 1.19 kH/s each against about 0.38 for the others (derived). Inference: these servers mine faster than the average rig on this pool. Huntback's reading is that N-central is the operator's latest addition to a mining operation that picks up new exploits within hours.

The Legacy API condition: a default is not a control

Two statements sit side by side. The researcher, per BleepingComputer, says exploitation requires the platform's Legacy API functionality to be enabled. N-able, per BleepingComputer, is urging on-premises customers to ensure Legacy API access is disabled, which BleepingComputer's sentence calls "already the default" (the article does not make clear whether that remark is N-able's or its own). If both hold, the 19 servers on Hotfix 2 either had a non default setting turned on, or something other than the setting made them reachable, or Huntback's build reading is wrong. Huntback does not say which. Its page says only that public reporting links the exploit to Hotfix 2 when the Legacy API is enabled, and it advises keeping the Legacy API disabled "while the 4EverAble2Shell fix is outstanding".

A source note. Huntback's sources list includes a Tenable FAQ. The copy saved for this briefing is dated 11 November at 00:55 US Eastern time in its page data, before the exploit, and does not mention the Legacy API, 4EverAble2Shell or Agent2Shell. It cannot be the support for the Legacy API sentence. The sentence's support is therefore the researcher's own claim as BleepingComputer relays it, which this briefing could not check against the repository.

The friendly label here is twofold. "Patched" is a label for a build number, and Huntback's 19 are the evidence that the number is not the control. "Disabled by default" is a label for the shipped state, not for the state of a given server, and it tells a defender nothing until someone looks at that server. The honest check is the setting itself on every N-central server, and the access to it.

Does the flaw have a CVE? Apache assigned one for the Axis step, and nothing read covers the rest

BleepingComputer says the chain combines an Apache Axis vulnerability, tracked as CVE-2026-90436, with a separate N-central privilege escalation weakness. Previdian's page for its own entry, which its overview describes as the chain, says "No CVE Assigned Yet". Both can hold. The CVE.org record for CVE-2026-90436, read at 20:02 UTC on 12 November, was assigned by Apache, reserved on 11 September and published on 6 November, six days before these exploits. It is a flaw in Apache Axis 1.x, a product the record calls end of life, and it does not name N-central or N-able.

Three notes on that. First, the 9.8 vector is CISA-ADP's, not Apache's, and not N-able's; Previdian's page prints the same score and the same vector for its own entry without saying who scored it (this site observes the match; it does not say Previdian copied it). Second, CISA-ADP's "exploitation none" was a reading taken at 18:37 UTC on 10 November, two days before Huntback's sightings: a time stamped reading, now overtaken. Third, CISA's Known Exploited Vulnerabilities catalogue, release 2026.11.10 (the release read at 20:03 UTC), lists five N-central CVEs, none of them this one. Previdian says its entry is not in the catalogue either. N-able's Hotfix 2 notes list seven CVEs, none of them CVE-2026-90436, and do not mention Axis, the Legacy API or 4EverAble2Shell. They do list two local privilege escalation records, one via a syslog-ng configuration and one via insecure IPC channels. Neither description matches the helper abuse that Previdian and BleepingComputer describe, though this briefing cannot say whether either covers it.

Where the sources differ

The differences stay as differences.

• What N-able has said. BleepingComputer, whose page data time is 19:51 UTC on 12 November, says that in its advisory N-able had seen no signs of compromise using the new flaws, and in the same article reports two security firms describing exploitation. This is BleepingComputer's paraphrase, not a quotation. N-able's advisory itself was not read: on this site's earlier attempt its robots file answered 403 and the page is script rendered, and the time of day at which N-able wrote it is not stated by BleepingComputer. So the advisory may predate Huntback's 12:50 reading or not; this briefing cannot say.
• Two firms, two units. Previdian counts 2 exploitation attempts from 1 attacker IP in 1 country on 1 sensor; Huntback counts a chain sent four times to decoys and 21 live rigs on a public pool. Different sensors, different things counted. Previdian says its attempt count "does not mean the attempt succeeded" and that its entry's affected range and fixed build are not verified.
• First sighting. BleepingComputer says Previdian first saw suspicious requests at about 08:30 UTC; Previdian's own timeline reads 08:24 UTC. Huntback says 08:30. The six minute difference is small and unexplained.
• When the exploit went public. Huntback, citing commit history, gives 03:58 UTC for the exploits and 07:48 for an update. Previdian's page lists the public proof of concept as created at 07:13 UTC, yet its own vulnerability entry is time stamped 06:12 UTC, 61 minutes earlier (derived). Nobody reconciles the two.
• What Previdian's entry covers. BleepingComputer says Previdian tracks the N-central privilege escalation flaw as VULN-2026-0009; Previdian's own overview describes the whole unauthenticated chain under that identifier. The two descriptions are not the same scope.
• The same address. BleepingComputer says Huntback saw the same attacker address as Previdian. Huntback's page does not mention Previdian, and Previdian's page shows no address (raw addresses are an Enterprise feature). That claim rests on neither primary read here.
• Earlier comfort. Tenable's FAQ of 11 November says that as of 10 November no confirmed compromise of a customer server had been reported, about the earlier set of flaws. Huntback's 21 postdates it by two days and concerns different exploits.
• The label. BleepingComputer's headline calls it a zero-day. Huntback's own prose (the word appears only in the titles of two articles it cites), Previdian's page and N-able's notes do not use that word for it; a CVE for the Axis step existed six days before the exploit went public.

What each source states, and what it does not

The right hand column is the negative column: each cell is something a reader might assume and the page read does not say.

What to do, in order

The first group is what N-able advises, as BleepingComputer quotes it; N-able's advisory page was not read, so check it for anything newer. The second is what Huntback advises. The third group is this site's suggestions and is labelled as such.

Technical details

Huntback prints indicators and a defender check list. This briefing copies them, defanged, and prints nothing that runs: no commands, no encoded strings, no request bodies and no sequence of the escalation. Do not visit, resolve or probe any address below. The primary prints more operational detail than a defender needs; this briefing leaves it out on purpose. The names and numbers below are the page's, read on 12 November 2026.

Files, persistence and processes. The host side checks as Huntback lists them, with the page's list punctuation tidied. A defender searches for each path on the server, reviews the systemd unit and the cron entries, and checks running processes for the two command line markers.

Files:
  /tmp/.xvd/ or /var/tmp/.xvd/ (x, keep.sh, xm.log)
  serverchild-*.bak, serverchild-*.sh or serverchild-*.out in /var/opt/n-central/tmp/
  a symlink at /var/opt/n-central/flag/flag_default.json
Persistence:
  /etc/systemd/system/xvd.service
  /etc/cron.d/xvd
  a crontab line ending # xvkeep for nable or root
Processes:
  anything with --rig-id nc_ or --donate-level 1 on its command line
  a binary named x running from .xvd

Network and logs. Outbound connections to the operator's host and to the two mining endpoints, and web requests to the Axis endpoint carrying a SOAP fault. A defender searches firewall, proxy and DNS logs for the addresses and ports, and the web server logs for the path and the element Huntback names.

Network:
  outbound to 157.20.241[.]16 (port 8080 and ports 19202 to 19418)
  outbound to 139.99.69[.]109:10128 or 79.76.51[.]56:39100
Logs:
  POSTs to /dms/services/ServerUI whose body holds a SOAP fault with an exceptionName element,
  in particular jline.internal.TerminalLineSettings

Indicator table. Huntback's indicators, as printed. The first six are infrastructure: block and search for them. The payload and beacon URLs are fetch locations on the operator's host, so a hit in proxy logs means a server tried to download from it.

157.20.241[.]16                  Exploitation source, payload host (:8080) and callback listener (TCP 19202 to 19418)
hxxp://157.20.241[.]16:8080/jup.sh   Miner installer fetched by the root command
hxxp://157.20.241[.]16:8080/xvgz , /xmrig.tgz   Miner binary (gzip; XMRig 6.26.0 tarball fallback)
hxxp://157.20.241[.]16:8080/ob/cronhit , /ob/fcheck   Installer check-in beacons
139.99.69[.]109:10128              Primary mining pool endpoint
79.76.51[.]56:39100                Fallback mining endpoint
python-requests/2.31.0             User-agent of the weaponised requests (checks used Mozilla/5.0)
/tmp/.xvd , /var/tmp/.xvd , xvd.service , # xvkeep , /etc/cron.d/xvd   Host artefacts
nc_<victim-ip>                     Rig ID the miner reports to the pool

Hash and wallet. The SHA-256 Huntback gives is for the escalation script, which this briefing does not reproduce; a defender can match it against files found on a server. The wallet is the operator's Monero address on the public pool, useful for searching threat intelligence and for confirming that a miner belongs to this operator. Both are as printed, 64 and 95 characters (derived counts).

fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747   SHA-256 of the nable-to-root Python script
41wx2Pv3FzfRvX11jQgzM4bRbgvr6GViRXCKkHhXhLVQ64mgUR5ks4CEzHx8zqUJ8MgsWwTaWiS3uiZbCgJQnNXoB19mGtr   Monero wallet

Versions. The build strings in the record, for comparing with an own console. A defender records the build and the Legacy API setting together; the pairing is the open question.

N-central 2026.4 Hotfix 2: Build Number: 2026.4.1.26 (N-able release notes, posted November 10, 2026)
As reported by Huntback: 19 servers on 2026.4.1.26, 1 server on 2025.3.1.9
Apache Axis 1.x: all versions through 1.4 (CVE-2026-90436 record, assigner Apache, published 2026-11-06)

Not printed by any primary read: a detection rule, a query, a Legacy API setting path or a way to check which build a server presents externally. This briefing does not invent them.

What was read, and what was not

Read in full: Huntback's post (page data date 12 November 2026, no time of day), Previdian's VULN-2026-0009 page (page times 12 November), BleepingComputer's article (page data time 19:51 UTC on 12 November, a secondary used only to find primaries and for statements it attributes to N-able and the researcher), N-able's Hotfix 2 release notes (posted 10 November), Tenable's FAQ (page data 11 November), the CVE.org record for CVE-2026-90436 and the CISA catalogue (release 2026.11.10). Not read: N-able's own 12 November advisory (its robots file answered 403 on an earlier attempt and the page is script rendered), NVD (a script rendered page), the researcher's repository (reported to hold working exploit code) and the mining pool page. No address from the indicators was visited.

The question the record leaves open

If exploitation needs a setting that BleepingComputer reports as off by default, and 19 servers on the patched build were mining within nine hours of the exploit appearing, who has checked what that setting was on those 19, and how many other N-central servers are in the same position tonight?

Key facts