# N-central attacks compromise 21 servers, including 19 running Hotfix 2

_Published Friday, November 13, 2026 at 11:32 PM EST · Security · Latest · Tier 1 — Major_

![N-central attacks compromise 21 servers, including 19 running Hotfix 2 — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhA4jxlXpPBPhD5o3IHy80Fn7fSHUtcqH3iXQlU-jDUL5C3zJcf1_Zb-GAYxuW6P6q647p9JAT_opImlj-v-USDNhZ_z83mYC3ISKtN72pe_3XLwf5EyMRuK4OdXCFnYxGMhOAvN_i4UFqk5vJLriRnkbRRwILuT5JUpExx9Tm74sXSCQ0g7jjsOzWV1cqk/s1700-nu-rw-lo-l85-e365/nable-hacks.jpg)

Attackers deployed a cryptocurrency miner on 21 N-central servers, including 19 already running Hotfix 2, security company Huntback reported. The Hacker News described active exploitation of the 4EverAble2Shell chain, which combines an Apache Axis vulnerability with an N-central privilege escalation weakness to obtain root access.

N-able said Thursday it had disabled the Legacy API by default and turned off Intune integration in hosted environments while adding protections. It urged customers to upgrade both Agents and Probes, which communicate with managed devices. On-premises customers should also disable Legacy API access if enabled. Huntback warned that the attackers' root access makes an affected management server a full compromise.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/hackers-exploit-n-central-flaws-to.html)

---
Canonical: https://techandbusiness.org/newswire/ztTZIhlIbJ4Vf3wNqVzeCT
Published: 2026-11-14T04:32:54.691Z
Story chronology: 2026-11-13T05:43:00.000Z
Retrieved: 2026-11-15T01:02:15.855Z
Publisher: Tech & Business (techandbusiness.org)