{"slug":"apache-axis-cve-2026-90436","title":"Apache Axis 1.x unauthenticated remote class instantiation (CVE-2026-90436)","shortName":"Apache Axis","summary":"CSIRT Italia AL02/261113/CSIRT-ITA (13 Nov 2026, 10:42 Italian time) reports active exploitation of CVE-2026-90436 (Italian: rilevato lo sfruttamento attivo in rete) and notes a public PoC. Apache has published no exploitation statement. Badge: Reported exploited (government: CSIRT Italia, 13 Nov 2026). The alert names no victims, sectors, IOCs, or first-seen date. Huntback 12 Nov remains the first public third-party report (21 N-central miners via 4EverAble2Shell). Axis 1.x is EOL; no fixed release. CSIRT Italia: migrate to a supported alternative such as Apache Axis2, or apply the Apache advisory patch by hand. Not in CISA KEV (catalog 2026.11.13, 1,781 entries, checked 14 Nov 2026). Public PoC indexed Unverified. N-able still has no statement naming this CVE.","isExample":false,"draft":false,"family":"apache-axis-cve-2026-90436","kind":"shared-component","aliases":["CVE-2026-90436","GHSA-988f-c54m-f8jj","Apache Axis 1.x SOAP fault class instantiation","4EverAble2Shell Axis stage","CONFSERVER-104610"],"publishedAt":"2026-11-13","updatedAt":"2026-11-14","patchStatus":"partly-patched","exploited":"reported","scores":{"cve":"CVE-2026-90436","cvss":{"cve":"CVE-2026-90436","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cisa-adp","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90436","sourceDate":"2026-11-12","checkedDate":"2026-11-13","dateLabel":"CISA ADP on NVD lastModified","sourceLabel":"CISA ADP on the NVD record (Secondary CVSS 3.1 9.8, source 134c704f-9b21-4f2e-91b3-4a467353bcc0). Apache CNA published no numeric CVSS. NVD vulnStatus Awaiting Analysis when read 13 Nov 2026. GHSA-988f-c54m-f8jj also shows Critical 9.8. Atlassian rates Confluence CVSS 4.0 9.3 separately.","nvdPublishedDate":"2026-11-06"},"epss":{"cve":"CVE-2026-90436","score":0.01128,"percentile":0.6682,"date":"2026-11-12","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-90436","checkedDate":"2026-11-13"},"kev":{"cve":"CVE-2026-90436","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.11.13","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-14"},"addedDate":"2026-11-13"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated remote class instantiation in EOL Apache Axis 1.x through 1.4 (CVE-2026-90436, CWE-470). CISA ADP CVSS 3.1 9.8. No Axis 1.x fix release. CSIRT Italia AL02/261113 (13 Nov 2026) reports active exploitation and a public PoC. Apache has published no exploitation statement. Badge: Reported exploited (government: CSIRT Italia, 13 Nov 2026). Huntback 12 Nov reported 21 N-central miners via 4EverAble2Shell. Not in CISA KEV (catalog 2026.11.13, checked 14 Nov 2026).","action":"Find Axis 1.x jars (Maven axis:axis or org.apache.axis:axis). Turn off and firewall exposed Axis SOAP endpoints: N-central Legacy API off, Confluence Remote API (XML-RPC and SOAP) off. Patch Confluence Data Center to 9.2.28 or move to 10.x. Migrate to a supported SOAP engine such as Apache Axis2, or apply the Apache advisory patch (commit 41f3b4e8). Treat Legacy-API-exposed N-central servers since 12 Nov 2026 as possibly compromised and hunt with the indicators on this page."},"seenInTheWild":[{"metric":"third-party-stated","value":"Active exploitation of CVE-2026-90436 detected on the network; a public PoC is available","observer":"CSIRT Italia","date":"2026-11-13","method":"CSIRT Italia AL02/261113/CSIRT-ITA, published 13 Nov 2026 10:42 Italian time on the ACN portal (CSIRT Italia). Italian: rilevato lo sfruttamento attivo in rete. The alert names no victims, sectors, IOCs, or first-seen date. Toscana CSIRT republished the same text as a regional mirror. Apache has published no exploitation statement. Badge: Reported exploited (government: CSIRT Italia, 13 Nov 2026).","sourceUrl":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436"},{"metric":"compromised","value":21,"observer":"Huntback","date":"2026-11-12","method":"Huntback (12 Nov 2026): at 12:50 UTC the operator's public pool listed 21 active nc_ rigs that had submitted a valid share in the previous five minutes. All 21 IPs served the N-central login page. Huntback calls them production servers. 19 reported build 2026.4.1.26 (HF2); one reported 2025.3.1.9. Success is inferred from pool shares, not host forensics. Victim IPs not published. Huntback does not cite CVE-2026-90436. Badge: Reported exploited (government: CSIRT Italia, 13 Nov 2026).","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers"},{"metric":"scanning","value":"3 attempts from 2 IPs in 2 countries on 1 sensor (first observed 12 Nov 2026, last 13 Nov 2026)","observer":"Previdian","date":"2026-11-12","method":"Previdian CVE-2026-90436 page, checked 13 Nov 2026. Observations do not show that the target was vulnerable or that the attempt succeeded. Previdian told The Hacker News its N-central honeypot saw probing and full-chain attempts from 157.20.241[.]16. That is targeting confidence, not a success claim.","sourceUrl":"https://previdian.com/CVE-2026-90436"},{"metric":"scanning","value":"Probes for 4EverAble2Shell against Legacy-API-enabled N-central builds","observer":"watchTowr","date":"2026-11-12","method":"SecurityWeek (Ionut Arghire, 13 Nov 2026) quotes WatchTowr: \"New N-able zero-days are out, and WatchTowr Intel is already seeing probes for ‘4EverAble2Shell’, which affects builds with the Legacy API enabled.\" Probes only. Earlier citation was The Hacker News aggregator of the same X post.","sourceUrl":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/"},{"metric":"third-party-stated","value":"No evidence of successful exploitation as of writing","observer":"The Hacker News","date":"2026-11-12","method":"Ravie Lakshmanan, 12 Nov 2026, citing Previdian. That article predates or does not include Huntback's later 21-server pool report. Keep both dated.","sourceUrl":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html"},{"metric":"third-party-stated","value":"At least 21 affected systems, including 19 running the latest security update","observer":"BleepingComputer","date":"2026-11-12","method":"Lawrence Abrams, 12 Nov 2026 02:51 PM. The attack combines an Apache Axis vulnerability, tracked as CVE-2026-90436, with a separate N-central privilege-escalation weakness. Reports the 21 compromises and the matching IP.","sourceUrl":"https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/"},{"metric":"vendor-stated","value":"N-able's November 12 update says it has seen no signs of compromise","observer":"N-able","date":"2026-11-12","method":"Tenable FAQ change log, 12 Nov 2026. N-able has not named CVE-2026-90436. Apache has published no exploitation statement. Badge: Reported exploited (government: CSIRT Italia, 13 Nov 2026).","sourceUrl":"https://www.tenable.com/blog/able2shell-frequently-asked-questions-for-reported-n-able-n-central-zero-day-vulnerabilities"},{"metric":"third-party-stated","value":"21 miners on compromised N-central servers; decoys never execute payloads","observer":"Lupovis","date":"2026-11-13","method":"Lupovis quoted by SecurityWeek, 13 Nov 2026. Geography: US 9, South Africa 4, Canada 4, plus UK, Germany, France and Sweden. The 21 matches Huntback's 21 already on this page. The 4EverAble2Shell chain starts with Apache Axis code execution. Badge: Reported exploited (government: CSIRT Italia, 13 Nov 2026).","sourceUrl":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/"},{"metric":"vendor-stated","value":"Additional indicators of compromise at specific customers","observer":"N-able","date":"2026-11-13","method":"N-able incident 202613 JSON fetched 13 Nov 2026. Update 2026-11-13T03:50:42 UTC: \"Through our ongoing investigation today, we have identified additional Indicators of Compromise (IOCs) and are working closely with those specific customers to assess and mitigate any potential risks.\" N-able has not named CVE-2026-90436. Not a vendor ITW mark. Keep the 12 Nov no-signs-of-compromise line dated next to this update.","sourceUrl":"https://uptime.n-able.com/event/202613/"}],"seenInTheWildLinks":[{"title":"Apache Axis: rilevato sfruttamento in rete della CVE-2026-90436 (AL02/261113/CSIRT-ITA)","url":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436","observer":"CSIRT Italia","metric":"third-party-stated"},{"title":"N-central Critical Security Update (incident 202613)","url":"https://uptime.n-able.com/event/202613/","observer":"N-able","metric":"vendor-stated"},{"title":"Hackers Exploit New N-central Zero-Day Hours After PoC Publication","url":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","observer":"Lupovis","metric":"third-party-stated"},{"title":"N-central 4EverAble2Shell miners on live servers","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","observer":"Huntback","metric":"compromised"},{"title":"CVE-2026-90436 Exploitation Attempts Observed","url":"https://previdian.com/CVE-2026-90436","observer":"Previdian","metric":"scanning"},{"title":"New N-able 4EverAble2Shell zero-day exploited hours after PoC released","url":"https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/","observer":"BleepingComputer","metric":"third-party-stated"},{"title":"New N-central exploits work against patched servers","url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","observer":"The Hacker News","metric":"scanning"}],"whatChanged":{"date":"2026-11-14","items":[{"text":"CSIRT Italia alert AL02/261113/CSIRT-ITA (published 13 Nov 2026, 10:42 Italian time) states that active exploitation of CVE-2026-90436 has been detected on the network (Italian: rilevato lo sfruttamento attivo in rete) and that a public PoC is available. Original live page is the ACN CSIRT Italia alert. The Toscana CSIRT page is a verified regional mirror; www.csirt.gov.it/contenuti/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436-al02-261113-csirt-ita returned 404 when fetched 14 Nov 2026. The alert names no victims, sectors, IOCs, or first-seen date. Apache has published no exploitation statement. Badge stays Reported exploited (government: CSIRT Italia, 13 Nov 2026). PoC index stays Unverified.","headline":"CSIRT Italia reports active exploitation; badge stays Reported exploited","section":"exploitation","date":"2026-11-14","sourceUrl":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436","alsoSourceUrl":"https://csirt.regione.toscana.it/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436-al02-261113-csirt-ita/","addedDate":"2026-11-14"},{"text":"CSIRT Italia, in line with the vendor, says Axis 1.x is end of support and the vendor will not ship an update. Plan a migration to a supported alternative such as Apache Axis2. Where that is not possible, apply the Apache advisory patch by hand (commit 41f3b4e8). No Axis 1.x fix release.","headline":"CSIRT Italia: migrate to Axis2 or apply the Apache patch","section":"mitigations","date":"2026-11-14","sourceUrl":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436","alsoSourceUrl":"https://lists.apache.org/thread/8slf0j9gz35z56t0glt5h0ncwlbn4bdz","addedDate":"2026-11-14"},{"text":"Rechecked CISA KEV catalog 2026.11.13 (released 2026-11-13T20:24:18.3008Z, 1,781 entries) on 14 Nov 2026: CVE-2026-90436 is still not listed, and no Able2Shell CVE is listed either. Apache still says it does not expect to create an Axis 1.x release fixing this problem. N-able still has no statement naming this CVE. Badge stays Reported exploited.","headline":"Still not in CISA KEV; N-able still has not named this CVE","section":"fixed-versions","date":"2026-11-14","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://lists.apache.org/thread/8slf0j9gz35z56t0glt5h0ncwlbn4bdz","addedDate":"2026-11-14"},{"text":"Lupovis, quoted by SecurityWeek 13 Nov 2026, reports 21 miners on compromised N-central servers (US 9, South Africa 4, Canada 4, plus UK, Germany, France and Sweden) and says its decoys never execute payloads. That 21 matches Huntback's 21 production N-central miners already on this page. The 4EverAble2Shell chain starts with Apache Axis code execution. Previdian and BleepingComputer identify that stage as CVE-2026-90436. Badge stays Reported exploited.","headline":"Lupovis reports 21 compromised N-central servers; same chain starts with Axis","section":"exploitation","date":"2026-11-13","sourceUrl":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","alsoSourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","addedDate":"2026-11-13"},{"text":"N-able incident 202613 update 13 Nov 2026 03:50:42 UTC reports additional indicators of compromise at specific customers: \"Through our ongoing investigation today, we have identified additional Indicators of Compromise (IOCs) and are working closely with those specific customers to assess and mitigate any potential risks.\" That is not a vendor ITW mark for CVE-2026-90436. N-able has not named this CVE. The 12 Nov 202613 notice still says N-able has seen no signs of compromise. Badge stays Reported exploited. Cross-link: Able2Shell catalog page.","headline":"N-able reports IoCs at specific customers; still not a vendor ITW mark","section":"exploitation","date":"2026-11-13","sourceUrl":"https://uptime.n-able.com/event/202613/","alsoSourceUrl":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","addedDate":"2026-11-13"},{"text":"Rechecked CISA KEV catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries) on 13 Nov 2026 18:55 SGT: CVE-2026-90436 is still not listed, and no Able2Shell CVE is listed either. Apache still says it does not expect to create an Axis 1.x release fixing this problem. Badge stays Reported exploited.","headline":"Still not in CISA KEV; no Axis 1.x fix","section":"fixed-versions","date":"2026-11-13","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://www.openwall.com/lists/oss-security/2026/11/06/12","addedDate":"2026-11-13"},{"text":"New catalog page for Apache Axis 1.x CVE-2026-90436, the unauthenticated SOAP-fault class instantiation used as stage 1 of 4EverAble2Shell.","headline":"New catalog page for Apache Axis CVE-2026-90436","section":"overview","date":"2026-11-13","addedDate":"2026-11-13","kind":"page"}]},"whatTheBugIs":"14 Nov 2026. CSIRT Italia alert AL02/261113/CSIRT-ITA (published 13 Nov 2026, 10:42 Italian time) states that active exploitation of CVE-2026-90436 has been detected on the network (Italian: rilevato lo sfruttamento attivo in rete) and that a public PoC is available. Original live page: Agenzia per la cybersicurezza nazionale (ACN) CSIRT Italia. The Toscana CSIRT page is a verified regional mirror; www.csirt.gov.it/contenuti/... returned 404 when fetched 14 Nov 2026. The alert names no victims, sectors, IOCs, or first-seen date. Apache has published no exploitation statement. Badge: Reported exploited (government: CSIRT Italia, 13 Nov 2026). Huntback 12 Nov remains the first public third-party report. Rechecked CISA KEV catalog 2026.11.13 (released 2026-11-13T20:24:18.3008Z, 1,781 entries) on 14 Nov 2026: still not listed. CSIRT Italia: migrate to a supported alternative such as Apache Axis2; where that is not possible, apply the Apache advisory patch by hand. Axis 1.x is EOL; no fixed release. See [Able2Shell](/vulns/able2shell-n-able-n-central).\n\nEvening 13 Nov 2026. Lupovis, quoted by SecurityWeek, reports 21 miners on compromised N-central servers and says its decoys never execute payloads. That 21 matches Huntback. The 4EverAble2Shell chain starts with Apache Axis code execution. N-able incident 202613 update 03:50:42 UTC reports additional IoCs at specific customers; that is not a vendor ITW mark and N-able has not named this CVE. Rechecked CISA KEV catalog 2026.11.10 (1,779 entries) at 18:55 SGT: still not listed. No Axis 1.x fix release. Badge stays Reported exploited. See [Able2Shell](/vulns/able2shell-n-able-n-central).\n\nUnauthenticated remote class instantiation (CWE-470) in EOL Apache Axis 1.x, all versions through 1.4 (CVE-2026-90436). No Axis 1.x fix release will ship. First reported in-the-wild use 12 Nov 2026 as stage 1 of 4EverAble2Shell. Badge: Reported exploited (government: CSIRT Italia, 13 Nov 2026). Not in CISA KEV.\n\n\nCVE-2026-90436 is unauthenticated remote class instantiation (CWE-470) in Apache Axis 1.x. Robert Lazarski posted the Apache Axis security advisory on 6 Nov 2026 (Fri, 06 Nov 2026 15:32:01 +0000; 23:32 SGT). Apache: deserialization of an inbound SOAP fault allows unauthenticated remote class instantiation. When a SOAP Fault carries a detail/exceptionName element, Axis loads the named class. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. Maven coordinates: axis:axis and org.apache.axis:axis, through 1.4. Git: commits from aac718c6035435d96b39d6aebb9c078a13af7cc8 up to but not including 41f3b4e8d04e310ca81f86b92630ab2c11d608bd. Credit: Jose Apari-Pantigozo (OKIOK), per the Apache advisory.\n\nNo Axis 1.x fix release. Apache: The Apache Axis project does not expect to create an Axis 1.x release fixing this problem. Options: migrate to another SOAP engine (Apache suggests Axis2/Java) or use a build with upstream commit 41f3b4e8. The Hacker News (12 Nov 2026) quotes Previdian saying patches were released 6 Nov 2026; that is the commit, not an Axis 1.x release. Axis2/Java is not listed as affected; no source says it is not affected.\n\nCVE record: https://www.cve.org/CVERecord?id=CVE-2026-90436, tag unsupported-when-assigned, CNA Apache. NVD published 6 Nov 2026 16:18:59.763Z (7 Nov 00:18 SGT), lastModified 12 Nov 2026 17:06:26.857Z (13 Nov 01:06 SGT), vulnStatus Awaiting Analysis, no NVD-produced Primary. CISA ADP Secondary CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CISA ADP SSVC timestamp 2026-11-10T18:37:06.862801Z (11 Nov 02:37 SGT): Exploitation none, Automatable yes, Technical Impact total. That SSVC row predates the 12 Nov 2026 reports. GHSA-988f-c54m-f8jj Critical 9.8, published 2026-11-06T18:35:15Z, unreviewed. FIRST EPSS on 12 Nov 2026: 0.01128 (66.820th percentile).\n\nAttribution dispute (read this first): Huntback reports 21 N-central servers compromised via the 4EverAble2Shell chain, whose first stage is Apache Axis code execution. Previdian and BleepingComputer identify that stage as CVE-2026-90436. Huntback does not cite the CVE ID. N-able (12 Nov, via Tenable) says it has seen no signs of compromise. N-able's 11 Nov blog mentions only scanning tied to the earlier Able2Shell PoC. Apache has published no exploitation statement. CSIRT Italia AL02/261113 (13 Nov 2026) is a government in-the-wild report the vendor has not echoed. Badge: Reported exploited (government: CSIRT Italia, 13 Nov 2026). Not in CISA KEV (catalog 2026.11.13, released 2026-11-13T20:24:18.3008Z, 1,781 entries, checked 14 Nov 2026). The Hacker News as of writing on 12 Nov 2026: There is no evidence of successful exploitation. Keep that line dated next to Huntback.\n\nProduct gates. RCE needs a suitable class on the application's classpath, so exploitability depends on what each product bundles. N-central: researcher repo update 12 Nov 2026 07:48 UTC (15:48 SGT) and N-able via The Hacker News and GovInfoSecurity: depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet. Confluence Data Center: only if Remote API (XML-RPC and SOAP) is enabled; off by default for new installs since 3.0; removed in 10.0. Outside N-central, no public exploitation report against Confluence or other embedders was found when checked 13 Nov 2026. Atlassian cannot confirm if your instances have been affected.\n\nThis page does not copy exploit code, SOAP bodies, named Java classes, wallet addresses, or weaponisation steps. Index names and public links only.","attackPath":{"caption":"High-level only. Not a reproduction guide. No SOAP body, named Java class, or command examples. Code runs as the embedding application's account, not necessarily root. On N-central, Huntback describes Axis code execution as the nable user, then a separate local escalation.","steps":[{"id":"reach","label":"Reach an Axis 1.x SOAP endpoint","detail":"Network reach to an Apache Axis 1.x SOAP listener. No authentication. Product gates still apply (N-central Legacy API; Confluence Remote API)."},{"id":"app","label":"Inbound SOAP Fault","detail":"A SOAP Fault carrying detail/exceptionName is parsed while Axis resolves the target service, before any per-service handler chain. Apache: authentication handlers configured on a service do not protect against it."},{"id":"unsafe","label":"Remote class instantiation","detail":"CWE-470: Axis loads the named class. Loading runs the class static initializer. RCE still needs a suitable class on that application's classpath."},{"id":"exec","label":"Code as the app account","detail":"Execution is as the embedding process account. Huntback on N-central: Apache Axis code execution as the nable user. That is not a claim of root from this CVE alone."},{"id":"lpe","label":"Optional product-specific follow-on","detail":"On N-central, public reporting describes a separate local escalation (4EverAble2Shell) and then a Monero miner. That follow-on is not this CVE. See the Able2Shell catalog page for the N-central HF2 CVEs."}]},"exploitation":{"kev":{"listed":false,"date":"2026-11-10","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CVE-2026-90436 is not in CISA KEV (checked 14 Nov 2026) against catalog 2026.11.13 (released 2026-11-13T20:24:18.3008Z, 1,781 entries). No N-central Able2Shell CVE is in that catalog either. Previdian added this CVE to its own KEV feed on 12 Nov 2026; Brandefense ATLAS labelled an Industry KEV feed the same day. Those are non-government feeds, not CISA KEV."},"firstSeen":{"date":"2026-11-13","source":"CSIRT Italia","note":"Reported exploited (government: CSIRT Italia, 13 Nov 2026). CSIRT Italia AL02/261113/CSIRT-ITA, published 13 Nov 2026 10:42 Italian time on the ACN portal, states that active exploitation of CVE-2026-90436 has been detected on the network and that a public PoC is available. The alert names no victims, sectors, IOCs, or first-seen date. Apache has published no exploitation statement. Huntback 12 Nov remains the first public third-party report (21 N-central miners). Badge: Reported exploited.","dateLabel":"Reported exploited (government: CSIRT Italia)"},"vendorStatements":[{"vendor":"CSIRT Italia","date":"2026-11-13","statement":"Rilevato lo sfruttamento attivo in rete della CVE-2026-90436 - per la quale risulta disponibile anche un Proof of Concept (PoC).","url":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436","retracted":false},{"vendor":"N-able","date":"2026-11-12","statement":"N-able's November 12 update says it has seen no signs of compromise. N-able has not named CVE-2026-90436.","url":"https://www.tenable.com/blog/able2shell-frequently-asked-questions-for-reported-n-able-n-central-zero-day-vulnerabilities","retracted":false},{"vendor":"N-able","date":"2026-11-13","statement":"Through our ongoing investigation today, we have identified additional Indicators of Compromise (IOCs) and are working closely with those specific customers to assess and mitigate any potential risks.","url":"https://uptime.n-able.com/event/202613/","retracted":false}],"attributionDispute":"Huntback reports 21 N-central servers compromised via the 4EverAble2Shell chain, whose first stage is Apache Axis code execution. Previdian and BleepingComputer identify that stage as CVE-2026-90436."},"timeline":[{"date":"2026-11-06T15:32:01Z","event":"Robert Lazarski posted the Apache Axis 1.x advisory (Fri, 06 Nov 2026 15:32:01 +0000). All versions through 1.4. No Axis 1.x fix release expected. Credit: Jose Apari-Pantigozo (OKIOK).","source":{"title":"CVE-2026-90436: Apache Axis 1.x unauthenticated remote class instantiation","url":"https://www.openwall.com/lists/oss-security/2026/11/06/12","publisher":"oss-security / Apache"},"kind":"advisory","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-06T16:18:59.763Z","event":"NVD published CVE-2026-90436 (7 Nov 00:18 SGT). Tag unsupported-when-assigned. CNA Apache. GHSA-988f-c54m-f8jj published 2026-11-06T18:35:15Z.","source":{"title":"CVE-2026-90436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90436","publisher":"NVD"},"kind":"advisory","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-09","event":"BSI CERT-Bund WID-SEC-2026-4427: Atlassian Confluence, weakness enabling code execution. OpenAdvisories lists this advisory on 9 Nov 2026.","source":{"title":"WID-SEC-2026-4427","url":"https://www.openadvisories.org/vuln/CVE-2026-90436","publisher":"BSI CERT-Bund via OpenAdvisories"},"kind":"advisory","addedDate":"2026-11-13"},{"date":"2026-11-10T06:00:00Z","event":"Atlassian published CVE-2026-90436 for Confluence Data Center (advisory release 9 Nov 2026 22:00 PST / 10 Nov 14:00 SGT). Affected 1.x-9.x if Remote API (XML-RPC and SOAP) is enabled. Fixed 9.2.28. 10.x and Cloud not impacted. Ticket CONFSERVER-104610. CVSS 4.0 9.3.","source":{"title":"CVE-2026-90436 - Remote Code Execution in Confluence Data Center","url":"https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-1874560038.html","publisher":"Atlassian"},"kind":"advisory","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-10","event":"CERT-FR CERTFR-2026-AVI-1492: vulnerability in Atlassian Confluence Data Center, versions earlier than 9.2.28. Echoes the Atlassian bulletin.","source":{"title":"CERTFR-2026-AVI-1492","url":"https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1492/","publisher":"CERT-FR"},"kind":"advisory","addedDate":"2026-11-13"},{"date":"2026-11-10T18:37:06.862801Z","event":"CISA ADP SSVC on the NVD record: Exploitation none, Automatable yes, Technical Impact total. This timestamp predates the 12 Nov 2026 reports.","source":{"title":"CVE-2026-90436 NVD record (CISA ADP SSVC)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90436","publisher":"CISA ADP / NVD"},"kind":"other","addedDate":"2026-11-13"},{"date":"2026-11-10T19:03:29.8375Z","event":"CISA KEV catalog 2026.11.10 released (1,779 entries). CVE-2026-90436 is not listed. Rechecked 13 Nov 2026.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-13"},{"date":"2026-11-11","event":"N-able blog Update on N-central 2026.4 HF2 mentions scanning tied to the earlier Able2Shell PoC. It does not name CVE-2026-90436 or 4EverAble2Shell.","source":{"title":"Update on N-central 2026.4 HF2 and ongoing security response","url":"https://www.n-able.com/blog/update-on-n-central-2026-4-hf2-and-ongoing-security-response","publisher":"N-able"},"kind":"vendor","addedDate":"2026-11-13"},{"date":"2026-11-12T03:58:00Z","event":"Sean Bales added the 4EverAble2Shell researcher chain (GitHub MSPNightmare, formerly Oracle-Security). Huntback dates the add to 03:58 UTC (11:58 SGT). Legacy API requirement added 07:48 UTC (15:48 SGT).","source":{"title":"Able2Shell public folder on Oracle-Security/CVEs (for defenders)","url":"https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able","publisher":"Sean Bales"},"kind":"poc","key":true,"addedDate":"2026-11-13"},{"id":"exploitation-attempts","date":"2026-11-12T08:30:00Z","event":"Huntback: 157.20.241[.]16 first checked Huntback decoys at 08:30 UTC (16:30 SGT), user-agent Mozilla/5.0. BleepingComputer reports first requests about 16:30 SGT from the same account. Previdian first observed targeting of this CVE on 12 Nov 2026.","source":{"title":"N-central 4EverAble2Shell miners on live servers","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","publisher":"Huntback"},"kind":"reported","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-12T09:16:00Z","event":"Huntback: full chain from 09:16 UTC (17:16 SGT). Apache Axis code execution as the nable user, local escalation to root, then an XMRig Monero miner. Weaponised requests used user-agent python-requests/2.31.0.","source":{"title":"N-central 4EverAble2Shell miners on live servers","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","publisher":"Huntback"},"kind":"reported","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-12T12:50:00Z","event":"Huntback: at 12:50 UTC (20:50 SGT) the operator's public pool listed 21 active nc_ rigs. All 21 IPs served the N-central login page. 19 on build 2026.4.1.26 (HF2). Success inferred from pool shares, not host forensics.","source":{"title":"N-central 4EverAble2Shell miners on live servers","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","publisher":"Huntback"},"kind":"reported","key":true,"addedDate":"2026-11-13"},{"date":"2026-11-12","event":"N-able 12 Nov notices (uptime 202609 and 202613, via The Hacker News, GovInfoSecurity, Tenable FAQ): Legacy API is a non-default precondition; disable it now; hosted environments are not affected by this issue; Intune integration disabled; no signs of compromise; no fix yet; follow-up hotfix promised. HF2 does not protect against this chain.","source":{"title":"N-able uptime event 202609","url":"https://uptime.n-able.com/event/202609/","publisher":"N-able"},"kind":"vendor","addedDate":"2026-11-13"},{"date":"2026-11-12","event":"Previdian added CVE-2026-90436 to its KEV feed. Brandefense ATLAS labelled an Industry KEV feed the same day. Those are not CISA KEV.","source":{"title":"Previdian CVE-2026-90436","url":"https://previdian.com/CVE-2026-90436","publisher":"Previdian"},"kind":"other","addedDate":"2026-11-13"},{"date":"2026-11-13","event":"OpenAdvisories roll-up: Debian 12/13/14 and Ubuntu 16.04 through 26.10 axis packages still show No fix yet. No Metasploit module or Exploit-DB entry. FIRST EPSS 1.1%.","source":{"title":"OpenAdvisories CVE-2026-90436","url":"https://www.openadvisories.org/vuln/CVE-2026-90436","publisher":"OpenAdvisories"},"kind":"other","addedDate":"2026-11-13"},{"date":"2026-11-14","event":"Rechecked CISA KEV catalog 2026.11.13 (released 2026-11-13T20:24:18.3008Z, 1,781 entries) on 14 Nov 2026: CVE-2026-90436 is still not listed. N-able still has no statement naming this CVE. No Axis 1.x fix release.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-14"},{"date":"2026-11-13T09:42:00Z","event":"CSIRT Italia published alert AL02/261113/CSIRT-ITA (10:42 Italian time): active exploitation of CVE-2026-90436 detected on the network, and a public PoC is available. Original on the ACN CSIRT Italia page. Toscana CSIRT is a verified regional mirror. The alert names no victims, sectors, IOCs, or first-seen date. Apache has published no exploitation statement. Badge stays Reported exploited.","source":{"title":"Apache Axis: rilevato sfruttamento in rete della CVE-2026-90436 (AL02/261113/CSIRT-ITA)","url":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436","publisher":"CSIRT Italia"},"kind":"reported","key":true,"addedDate":"2026-11-14"},{"date":"2026-11-13T03:50:42Z","event":"N-able incident 202613 update 03:50:42 UTC reports additional IoCs at specific customers. Not a vendor ITW mark for this CVE. SecurityWeek the same day quotes Lupovis on 21 compromised N-central servers (decoys never execute payloads) and WatchTowr probes for 4EverAble2Shell on Legacy-API-enabled builds. Rechecked CISA KEV catalog 2026.11.10 at 18:55 SGT: still not listed.","source":{"title":"N-able incident 202613","url":"https://uptime.n-able.com/event/202613/","publisher":"N-able"},"kind":"vendor","key":true,"addedDate":"2026-11-13"}],"openNotes":[{"title":"Huntback does not cite the CVE ID","detail":"Huntback describes Apache Axis code execution as the nable user, then local root, then a miner. It does not print CVE-2026-90436. Previdian (via The Hacker News) and BleepingComputer identify that Axis stage as this CVE. This page records both. It does not resolve the missing CVE ID on Huntback.","sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"},{"url":"https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/","date":"2026-11-12","publisher":"BleepingComputer"}]},{"title":"THN found no success as of writing; Huntback later listed 21 rigs","detail":"The Hacker News (12 Nov 2026), citing Previdian, wrote there is no evidence of successful exploitation as of writing. Huntback the same day listed 21 production nc_ rigs on a public pool at 12:50 UTC. Lupovis (via SecurityWeek, 13 Nov) reports the same 21. N-able 12 Nov said it has seen no signs of compromise. N-able 13 Nov reports IoCs at specific customers; that is not a vendor ITW mark. Badge stays Reported exploited.","sources":[{"url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","date":"2026-11-12","publisher":"The Hacker News"},{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"},{"url":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","date":"2026-11-13","publisher":"SecurityWeek"},{"url":"https://uptime.n-able.com/event/202613/","date":"2026-11-13","publisher":"N-able"}]},{"title":"CSIRT Italia names no first-seen date, victims, sectors, or IOCs","detail":"AL02/261113/CSIRT-ITA (13 Nov 2026) reports active exploitation of CVE-2026-90436 and notes a public PoC. It does not name victims, sectors, IOCs, or a first-seen date. Huntback 12 Nov remains the first public third-party report. This page does not invent those fields from the alert.","sources":[{"url":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436","date":"2026-11-13","publisher":"CSIRT Italia"},{"url":"https://csirt.regione.toscana.it/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436-al02-261113-csirt-ita/","date":"2026-11-13","publisher":"CSIRT Toscana"}]},{"title":"Legacy API state of the 21 victims is unpublished","detail":"N-able says the server issue depends on a non-default Legacy API exposed to the public internet. Huntback did not publish whether those 21 hosts had Legacy API on. Tenable's 12 Nov FAQ records the Huntback report and the N-able notice together without that field.","sources":[{"url":"https://www.tenable.com/blog/able2shell-frequently-asked-questions-for-reported-n-able-n-central-zero-day-vulnerabilities","date":"2026-11-12","publisher":"Tenable"}]}],"defenderActions":[{"title":"Find Axis 1.x jars and exposed SOAP endpoints","detail":"Inventory axis-1.4.jar / axis.jar and Maven axis:axis or org.apache.axis:axis through 1.4. Record which hosts expose Axis SOAP, typically under /services/*. Do not send a SOAP Fault as a test.","priority":"now","links":[{"label":"Apache Axis oss-security advisory","href":"https://www.openwall.com/lists/oss-security/2026/11/06/12"}]},{"title":"Turn off N-central Legacy API and treat internet-exposed hosts as possibly compromised","detail":"N-able: disable Legacy API immediately if it is on. Hosted N-central is not affected by this issue (vendor statement). HF2 build 2026.4.1.26 does not protect against 4EverAble2Shell. Hunt from 12 Nov 2026. The N-central HF2 CVEs stay on the Able2Shell page.","priority":"now","links":[{"label":"N-able uptime event 202609","href":"https://uptime.n-able.com/event/202609/"},{"label":"Able2Shell catalog page","href":"/vulns/able2shell-n-able-n-central"}]},{"title":"Patch or migrate Confluence Data Center","detail":"Atlassian: patch to 9.2.28, or run 10.x where Remote API was removed. If you cannot patch, turn off Remote API (XML-RPC and SOAP). Cloud sites need no action.","priority":"now","links":[{"label":"Atlassian CVE-2026-90436 advisory","href":"https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-1874560038.html"}]},{"title":"Plan a patched Axis 1.x build or leave Axis 1","detail":"Apache will not ship an Axis 1.x release. CSIRT Italia (13 Nov 2026) restates that: migrate to a supported alternative such as Apache Axis2, or apply the Apache advisory patch by hand (commit 41f3b4e8). Axis2 is not listed as affected.","priority":"now","links":[{"label":"Upstream commit 41f3b4e8","href":"https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd"},{"label":"CSIRT Italia AL02/261113","href":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436"}]}],"detection":[{"title":"SOAP Fault POSTs to Axis 1.x endpoints","detail":"Hunt inbound POSTs to Axis 1.x SOAP endpoints (typically /services/*) whose body is a SOAP Fault carrying detail/exceptionName. Legitimate clients send requests, not faults. Bodies need WAF or app-level logging. A hit is a lead, not proof of code execution. Do not name a Java class from public write-ups.","logSource":"Web, reverse-proxy, WAF, or app-server logs with request bodies","kind":"generic","group":"web-proxy","url":"https://www.openwall.com/lists/oss-security/2026/11/06/12","date":"2026-11-06","described":true},{"title":"N-central ServerUI SOAP Fault POSTs","detail":"Hunt POSTs to /dms/services/ServerUI whose body is a SOAP Fault containing exceptionName naming a non-standard Java class. Do not treat the class name as a PoC. Huntback: that path is the Axis stage on N-central.","logSource":"N-central or reverse-proxy logs covering /dms/services/ServerUI","kind":"generic","group":"web-proxy","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","described":true},{"title":"Confluence Axis 1 SOAP servlet","detail":"Hunt requests to /plugins/servlet/soap-axis1/*. Atlassian: with Remote API off, that path should return HTTP 403. A 200 with an AXIS service message is a lead to re-check the mitigation, not proof of RCE.","logSource":"Confluence or reverse-proxy access logs","kind":"generic","group":"web-proxy","url":"https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-1874560038.html","date":"2026-11-10","described":true},{"title":"Java or Tomcat spawning shells, curl, wget, python, or flock","detail":"Hunt the embedding Java/Tomcat process (on N-central, the nable account) creating sh, bash, curl, wget, python, or flock. Then hunt root activity: new systemd units or cron files and XMRig-like command lines containing --rig-id or --donate-level 1 or --cpu-max-threads-hint. Huntback observed that sequence after Axis code execution.","logSource":"EDR or host process-creation telemetry","kind":"generic","group":"edr","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"N-central host artefacts from Huntback","detail":"Hunt /tmp/.xvd, /var/tmp/.xvd, serverchild-*.bak/.sh/.out in /var/opt/n-central/tmp/, a symlink at /var/opt/n-central/flag/flag_default.json, /etc/systemd/system/xvd.service, and /etc/cron.d/xvd. Presence is a lead for the published miner chain, not proof of this CVE alone.","logSource":"Linux host, FIM, or auditd","kind":"generic","group":"edr","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","fold":"compromise-check","described":true},{"title":"Egress to Huntback IOCs and generic Stratum mining","detail":"Hunt egress to 157.20.241[.]16 (port 8080 and TCP 19202-19418), 139.99.69[.]109:10128, and 79.76.51[.]56:39100. Also hunt generic Stratum mining egress. Attribute to Huntback. Do not treat an IP hit as this CVE without the Axis stage.","logSource":"Firewall, NetFlow, or DNS","kind":"generic","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","described":true},{"title":"Nuclei inventory templates (not a CVE detector)","detail":"nuclei-templates main, checked 13 Nov 2026 10:07 SGT: no CVE-2026-90436 YAML. Inventory YAML files exist: apache-axis-detect, axis-happyaxis, ncentral-panel. Detection only. Not indexed on /pocs. A panel or jar match is exposure, not exploitation.","logSource":"Nuclei inventory scan output","kind":"generic","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/technologies/apache/apache-axis-detect.yaml","date":"2026-11-13","dateKind":"checked"},{"title":"No ET Open, Snort/Talos, Tenable, Qualys, or Previdian virtual patch yet","detail":"ET Open emerging-all.rules: no CVE-2026-90436 rule when checked 13 Nov 2026 ~10:15 SGT. Snort/Talos, Tenable, and Qualys: none published yet when checked 13 Nov 2026. Previdian: no virtual patch on the CVE page the same day.","logSource":"IDS/IPS and scanner signature feeds","kind":"vendor-signature","url":"https://previdian.com/CVE-2026-90436","date":"2026-11-13","dateKind":"checked"}],"detectionRules":[{"id":"v2s-sigma-apache-axis-cve-2026-90436-soap-fault","title":"Axis 1.x SOAP Fault with exceptionName","language":"sigma","query":"title: Axis 1.x SOAP Fault with exceptionName\nid: 3e7c1a90-6d2b-4f11-9c4e-8a2f0b17d5c1\nstatus: experimental\ndescription: Hunts POSTs to Axis-like SOAP paths whose logged body contains a SOAP Fault and an exceptionName element. Path and element hunt only. Not a class-name or payload detector.\nreferences:\n    - https://www.openwall.com/lists/oss-security/2026/11/06/12\nauthor: vuln2shell\ndate: 2026-11-13\nlogsource:\n    category: webserver\ndetection:\n    method:\n        cs-method: 'POST'\n    path:\n        cs-uri-stem|contains:\n            - '/services/'\n            - '/dms/services/ServerUI'\n            - '/plugins/servlet/soap-axis1/'\n    body:\n        cs-body|contains|all:\n            - 'Fault'\n            - 'exceptionName'\n    condition: method and path and body\nfalsepositives:\n    - Application logs that record legitimate SOAP faults from broken clients\nlevel: medium","logSource":"Web, reverse-proxy, WAF, or app-server logs with request bodies","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.openwall.com/lists/oss-security/2026/11/06/12","sourceDate":"2026-11-06","license":"CC0 1.0","origin":"vuln2shell","notes":"Needs body logging. A SOAP Fault is unusual from a client. Tune field names to your shipper. No named Java classes.","tested":"untested"},{"id":"v2s-spl-apache-axis-cve-2026-90436-soap-fault","title":"Axis 1.x SOAP Fault with exceptionName (SPL)","language":"spl","query":"index=* (sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=waf)\nmethod=POST (\"/services/\" OR \"/dms/services/ServerUI\" OR \"/plugins/servlet/soap-axis1/\") (Fault AND exceptionName)\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, uri_path, status, useragent\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Web, reverse-proxy, or WAF logs with request bodies","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.openwall.com/lists/oss-security/2026/11/06/12","sourceDate":"2026-11-06","license":"CC0 1.0","origin":"vuln2shell","notes":"Body search only works if the shipper indexed the POST body. A hit is a lead, not proof of RCE.","tested":"untested"},{"id":"v2s-kql-apache-axis-cve-2026-90436-soap-fault","title":"Axis 1.x SOAP Fault with exceptionName (KQL)","language":"kql","query":"W3CIISLog\n| where TimeGenerated > ago(14d)\n| where csMethod == \"POST\"\n| where csUriStem has_any (\"/services/\", \"/dms/services/ServerUI\", \"/plugins/servlet/soap-axis1/\")\n| where csBytes > 0\n| where csUriQuery has \"exceptionName\" or csUriStem has \"exceptionName\"\n| summarize count(), min(TimeGenerated), max(TimeGenerated) by Computer, cIP, csUriStem, scStatus, csUserAgent\n| order by count_ desc","logSource":"IIS or custom web logs shipped to Microsoft Sentinel. Prefer WAF/app body logs over IIS query-string fields.","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.openwall.com/lists/oss-security/2026/11/06/12","sourceDate":"2026-11-06","license":"CC0 1.0","origin":"vuln2shell","notes":"IIS W3C logs often omit POST bodies. Map this hunt onto your WAF or app-log table if that is where SOAP bodies land.","tested":"untested"},{"id":"v2s-esql-apache-axis-cve-2026-90436-soap-fault","title":"Axis 1.x SOAP Fault with exceptionName (ES|QL)","language":"esql","query":"FROM logs-*\n| WHERE http.request.method == \"POST\" AND (url.path LIKE \"*/services/*\" OR url.path LIKE \"*/dms/services/ServerUI*\" OR url.path LIKE \"*/plugins/servlet/soap-axis1/*\") AND MATCH(http.request.body.content, \"Fault\") AND MATCH(http.request.body.content, \"exceptionName\")\n| STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, source.ip, url.path, http.response.status_code, user_agent.original","logSource":"Web or WAF logs shipped to Elastic with request bodies","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.openwall.com/lists/oss-security/2026/11/06/12","sourceDate":"2026-11-06","license":"CC0 1.0","origin":"vuln2shell","notes":"Field names vary by ingest pipeline. Do not add named Java classes to this hunt.","tested":"untested"},{"id":"v2s-suricata-apache-axis-cve-2026-90436-soap-fault","title":"Axis 1.x SOAP Fault with exceptionName (Suricata)","language":"suricata","query":"alert http any any -> $HOME_NET any (msg:\"vuln2shell Apache Axis 1.x SOAP Fault exceptionName (CVE-2026-90436 hunt)\"; flow:established,to_server; http.method; content:\"POST\"; http.uri; pcre:\"/\\/services\\/|\\/dms\\/services\\/ServerUI|\\/plugins\\/servlet\\/soap-axis1\\//\"; http.request_body; content:\"Fault\"; content:\"exceptionName\"; classtype:web-application-attack; sid:26090436; rev:1; metadata:cve CVE_2026_90436, created_at 2026_11_13;)","logSource":"Suricata IDS with HTTP body inspection (needs TLS decryption for HTTPS)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.openwall.com/lists/oss-security/2026/11/06/12","sourceDate":"2026-11-06","license":"CC0 1.0","origin":"vuln2shell","notes":"Element-name hunt only. No ET Open CVE-2026-90436 rule was found when checked 13 Nov 2026. Pick a sid in your local range if 26090436 collides.","tested":"untested"},{"id":"v2s-yara-apache-axis-cve-2026-90436-soap-fault","title":"Captured SOAP Fault with exceptionName (YARA)","language":"yara","query":"rule V2S_Apache_Axis_CVE_2026_90436_SoapFault\n{\n    meta:\n        author = \"vuln2shell\"\n        date = \"2026-11-13\"\n        description = \"Captured request or pcap extract containing a SOAP Fault and exceptionName. Not a class-name detector.\"\n        source = \"https://www.openwall.com/lists/oss-security/2026/11/06/12\"\n        license = \"CC0 1.0\"\n    strings:\n        $fault = \"Fault\" ascii wide\n        $ename = \"exceptionName\" ascii wide\n        $soap = \"Envelope\" ascii wide\n    condition:\n        all of them\n}","logSource":"Captured HTTP bodies, pcap extracts, or disk artefacts","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.openwall.com/lists/oss-security/2026/11/06/12","sourceDate":"2026-11-06","license":"CC0 1.0","origin":"vuln2shell","notes":"Matches protocol elements named in the Apache advisory. Expect hits on legitimate SOAP faults too. Do not add named Java classes.","tested":"untested"}],"detectionLinks":[{"title":"Nuclei apache-axis-detect","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/technologies/apache/apache-axis-detect.yaml","author":"projectdiscovery/nuclei-templates","date":"2026-11-13","note":"Inventory only. Checked on nuclei-templates main 13 Nov 2026 10:07 SGT. Not a CVE-2026-90436 detector. Not indexed on /pocs."},{"title":"Nuclei axis-happyaxis","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposures/files/axis-happyaxis.yaml","author":"projectdiscovery/nuclei-templates","date":"2026-11-13","note":"Inventory only. happyaxis is an Axis 1.x diagnostic page. Not indexed on /pocs."},{"title":"Nuclei ncentral-panel","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/exposed-panels/ncentral-panel.yaml","author":"projectdiscovery/nuclei-templates","date":"2026-11-13","note":"N-central login-panel inventory. Not a CVE detector. Not indexed on /pocs."}],"retrohunt":{"summary":"If Axis 1.x SOAP, N-central Legacy API, or Confluence Remote API was reachable from 12 Nov 2026, hunt SOAP Fault POSTs, nable-spawned shells, Huntback host artefacts, and egress to the IOCs below. Huntback's 21-server figure is a pool-share inference, not host forensics.","lookback":{"from":"2026-11-12","basis":"first-attempt","rationale":"Previdian first observed this CVE on 12 Nov 2026. Huntback dates the first check of its decoys to 08:30 UTC and the full chain to 09:16 UTC. Sean Bales added 4EverAble2Shell at 03:58 UTC. Use 12 Nov 2026 as the lower bound.","sources":[{"url":"https://previdian.com/CVE-2026-90436","date":"2026-11-12","publisher":"Previdian"},{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"}],"searchLine":"Search from 12 Nov 2026 (Previdian first observed targeting of CVE-2026-90436; Huntback first decoy check 08:30 UTC the same day)."},"logSources":[{"name":"Web, reverse-proxy, WAF, or app-server logs with POST bodies","why":"Apache: the bug is an inbound SOAP Fault with exceptionName. Huntback names POSTs to /dms/services/ServerUI on N-central.","required":true},{"name":"EDR or host process-creation telemetry for the Java / nable account","why":"Huntback: Axis code execution as nable, then shells, curl/wget/python, then root miner persistence.","required":true},{"name":"Linux FIM, auditd, systemd, and cron","why":"Huntback listed /tmp/.xvd, xvd.service, # xvkeep, and N-central tmp/flag paths.","required":false},{"name":"Firewall, NetFlow, or DNS","why":"Huntback published exploitation-source, callback, and mining endpoints.","required":false}],"steps":[{"title":"List SOAP Fault POSTs to Axis paths since 12 Nov 2026","detail":"Search for POSTs to /services/*, /dms/services/ServerUI, or /plugins/servlet/soap-axis1/* whose body contains Fault and exceptionName. A hit is a lead. Do not send a test body.","sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/06/12","date":"2026-11-06","publisher":"oss-security / Apache"},{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"}]},{"title":"List nable or Java child processes and Huntback host artefacts","detail":"Hunt sh/bash/curl/wget/python/flock from the application account, then /tmp/.xvd, xvd.service, # xvkeep, and the N-central tmp/flag paths. Presence is a lead for the published miner chain.","sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"}]},{"title":"List egress to Huntback IOCs","detail":"Hunt 157.20.241[.]16 (8080 and TCP 19202-19418), 139.99.69[.]109:10128, and 79.76.51[.]56:39100 from 12 Nov 2026. Attribute to Huntback.","sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"}]}],"queries":[{"id":"v2s-spl-apache-axis-cve-2026-90436-retrohunt-soap","title":"SOAP Fault POSTs since 12 Nov 2026","language":"spl","query":"index=* earliest=11/12/2026:00:00:00 method=POST (\"/services/\" OR \"/dms/services/ServerUI\" OR \"/plugins/servlet/soap-axis1/\") (Fault AND exceptionName)\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src values(useragent) as ua by host, uri_path, status\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Web, reverse-proxy, or WAF logs with request bodies","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.openwall.com/lists/oss-security/2026/11/06/12","sourceDate":"2026-11-06","license":"CC0 1.0","origin":"vuln2shell","notes":"Lookback from Previdian/Huntback 12 Nov 2026. Tune sourcetype to your shipper.","tested":"untested","timeRange":"From 12 Nov 2026 (first observed targeting) through the last Legacy API / Remote API change"}],"artefacts":[{"kind":"web-log","value":"POST to /dms/services/ServerUI with a SOAP Fault containing exceptionName","detail":"Huntback hunting pointer for the N-central Axis stage. A request is reachability plus a SOAP Fault, not proof of code execution. This page does not name the Java class Huntback printed.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"kind":"file","value":"/tmp/.xvd or /var/tmp/.xvd","detail":"Huntback miner working directory.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"kind":"file","value":"serverchild-*.bak / .sh / .out in /var/opt/n-central/tmp/ and symlink /var/opt/n-central/flag/flag_default.json","detail":"Huntback leftover files from the nable-to-root helper.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"kind":"process","value":"Command line containing --rig-id nc_ or --donate-level 1","detail":"Huntback miner command-line fragments. This page does not copy the full command.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"}],"iocs":[{"type":"ip","value":"157.20.241[.]16","context":"Huntback: exploitation source, payload host on TCP 8080, and callback listener on TCP 19202 to 19418.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"ip","value":"139.99.69[.]109:10128","context":"Huntback: primary mining pool endpoint.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"ip","value":"79.76.51[.]56:39100","context":"Huntback: fallback mining endpoint.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"hash","value":"fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747","context":"Huntback: SHA-256 of the nable-to-root Python script. Do not treat a hash hit as this CVE without the Axis stage.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"user-agent","value":"python-requests/2.31.0","context":"Huntback: user-agent of the weaponised requests. Checks used Mozilla/5.0.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"user-agent","value":"Mozilla/5.0","context":"Huntback: user-agent on the first checks of decoys. Generic; only useful next to the other IOCs.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"path","value":"/tmp/.xvd","context":"Huntback host artefact.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"path","value":"/var/tmp/.xvd","context":"Huntback host artefact when /tmp is unusable.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"filename","value":"xvd.service","context":"Huntback: systemd unit name.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"path","value":"/etc/cron.d/xvd","context":"Huntback cron artefact.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"type":"username","value":"nc_","context":"Huntback: miner rig ID prefix nc_<victim-ip>. Not a login username.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"}],"iocNote":"11 Huntback indicators (12 Nov 2026), defanged as published: 157.20.241[.]16 (source, payload host :8080, callbacks TCP 19202-19418); mining 139.99.69[.]109:10128 and 79.76.51[.]56:39100; SHA-256 fc4c01fd11bc301cf312830460cfdccc3af9dcfe50c910b86d6a1117bc76c747; host paths /tmp/.xvd, /var/tmp/.xvd, xvd.service, /etc/cron.d/xvd; user-agents python-requests/2.31.0 and Mozilla/5.0; rig prefix nc_. Wallet, request bodies, named Java classes, and installer commands are omitted.","hitMeaning":[{"level":"attempt","detail":"A SOAP Fault POST to an Axis path, or Previdian/watchTowr-style probing, is targeting. Previdian: observations do not show the target was vulnerable or that the attempt succeeded."},{"level":"likely-compromise","detail":"nable or Java spawning shells plus Huntback host artefacts or egress to 157.20.241[.]16 is a strong lead for the published chain. Huntback did not publish victim IPs or Legacy API state."},{"level":"compromise","detail":"A live nc_ rig on the public pool, plus an N-central login page on that IP, is how Huntback inferred 21 compromises. Huntback is third-party. CSIRT Italia (13 Nov 2026) separately reports active exploitation of this CVE and names no victim count.","label":"Reported compromise (third-party)"}],"nextSteps":[{"title":"If you have a hit, treat the N-central host as fully compromised","detail":"Huntback: the miner is the only payload seen, but the escalation hands the operator root on a host that manages customer endpoints.","priority":"now","links":[{"label":"Huntback 4EverAble2Shell miners","href":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers"}]}],"limits":["Do not send SOAP Faults or named Java classes as a hunt.","Huntback does not cite CVE-2026-90436.","Wallet, request bodies, and installer commands are omitted on purpose.","Mozilla/5.0 alone is not an indicator."],"sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"},{"url":"https://previdian.com/CVE-2026-90436","date":"2026-11-12","publisher":"Previdian"}],"updatedAt":"2026-11-14"},"amIAffected":{"summary":"Apache Axis 1.x through 1.4 is in scope. Inventory the jar or Maven coordinate, then record whether an Axis SOAP endpoint, N-central Legacy API, or Confluence Remote API is exposed. Do not send a SOAP Fault as a test.","checks":[{"id":"v2s-aia-apache-axis-cve-2026-90436-package-1","kind":"package","title":"Find Axis 1.x jars and Maven coordinates","detail":"Apache: all Axis 1.x through 1.4. Record axis-1.4.jar, axis.jar, or Maven axis:axis / org.apache.axis:axis. This is inventory only.","command":"Search SCA/SBOM output and filesystems for axis-1.4.jar, axis.jar, Maven axis:axis, and org.apache.axis:axis, then record the version.","affectedMeans":"A recorded version is 1.4 or earlier, or the jar is present and the version is 1.x.","fixedMeans":"No Axis 1.x jar is present, or the install is a custom build that includes commit 41f3b4e8 (no Axis 1.x release exists to match against).","notes":"A jar hit is not proof the SOAP endpoint is exposed. Axis2/Java is a different engine and is not listed as affected.","sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/06/12","date":"2026-11-06","publisher":"oss-security / Apache"}]},{"id":"v2s-aia-apache-axis-cve-2026-90436-config-1","kind":"config","title":"Record N-central Legacy API state","detail":"N-able: the 12 Nov server issue depends on a non-default Legacy API turned on and exposed to the public internet. Record whether Legacy API is enabled and whether untrusted networks can reach it. Do not send a SOAP request as a test.","command":"Record the N-central Legacy API setting and whether any non-admin network can complete a connection to that API.","affectedMeans":"On-prem N-central with Legacy API on and reachable from an untrusted network.","fixedMeans":"Legacy API is off, or the server is N-able hosted NCOD (vendor: hosted not affected by this issue), or N-central is not installed.","notes":"HF2 2026.4.1.26 does not protect against 4EverAble2Shell. Hosted not-affected is a vendor statement about this issue, not a claim about other CVEs.","sources":[{"url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","date":"2026-11-12","publisher":"The Hacker News"}]},{"id":"v2s-aia-apache-axis-cve-2026-90436-config-2","kind":"config","title":"Record Confluence Remote API (XML-RPC and SOAP)","detail":"Atlassian: Confluence Data Center 1.x-9.x is in scope only if Remote API (XML-RPC and SOAP) is enabled. Off by default for new installs since 3.0. Removed in 10.0. Cloud not impacted.","command":"Record whether Remote API (XML-RPC and SOAP) is enabled under Confluence General Configuration, Further Configuration, and the installed Confluence version.","affectedMeans":"Confluence Data Center 1.x-9.x below 9.2.28 with Remote API enabled.","fixedMeans":"Version is 9.2.28 or later, or 10.x, or Cloud, or Remote API is off.","notes":"Atlassian verify URL is /plugins/servlet/soap-axis1/confluenceservice-v2; a 403 means the mitigation is on. Do not send a SOAP body.","sources":[{"url":"https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-1874560038.html","date":"2026-11-10","publisher":"Atlassian"}]},{"id":"v2s-aia-apache-axis-cve-2026-90436-exposure-1","kind":"exposure","title":"Scope internet-facing Axis, N-central, and Confluence SOAP listeners","detail":"Record who can complete a connection to Axis SOAP (typically /services/*), N-central /dms/services/ServerUI, or Confluence /plugins/servlet/soap-axis1/*. Exposure counts are not vulnerable counts. Do not send a test body.","command":"shodan search 'http.html:\"N-central\" net:<your-range>' ; censys search 'services.http.response.body:\"N-central Login\" and host.ip: net:<your-range>'","affectedMeans":"An in-scope product from the checks above is reachable from a network that is not a trusted admin network.","fixedMeans":"No Axis SOAP, N-central Legacy API, or Confluence Remote API listener is reachable from untrusted networks, or the product is on a fixed version / Cloud / hosted NCOD.","notes":"No sourced Shodan fingerprint for Axis SOAP itself. The N-central strings are inventory only. Scope every internet search with net:<your-range> or org:\"<your org>\".","sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"}]}],"limits":["Do not send a SOAP Fault, exceptionName, or any crafted Axis request as a test.","A jar or panel match is inventory, not proof of exploitation.","N-able has not named CVE-2026-90436. Hosted not-affected is the 12 Nov Legacy API notice.","Axis2/Java, Confluence 10.x, and Confluence Cloud statements do not cover other embedders."],"sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/06/12","date":"2026-11-06","publisher":"oss-security / Apache"},{"url":"https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-1874560038.html","date":"2026-11-10","publisher":"Atlassian"},{"url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","date":"2026-11-12","publisher":"The Hacker News"}],"updatedAt":"2026-11-13","addedDate":"2026-11-13"},"mitigations":{"summary":"CSIRT Italia (13 Nov 2026), in line with Apache: Axis 1.x is EOL and will not get a fix release. Migrate to a supported alternative such as Apache Axis2. Where that is not possible, apply the Apache advisory patch (commit 41f3b4e8) by hand. N-able: disable Legacy API. Atlassian: disable Remote API (XML-RPC and SOAP) if you cannot patch to 9.2.28.","items":[{"title":"Migrate off Axis 1.x or apply the Apache patch by hand","detail":"CSIRT Italia AL02/261113 (13 Nov 2026), citing the vendor: Axis 1.x has reached end of support and the vendor will not ship an update. Plan a migration to a supported alternative such as Apache Axis2. Where that is not possible, apply the Apache advisory patch by hand from the 6 Nov 2026 Axis security bulletin (commit 41f3b4e8).","limits":"Not an Axis 1.x fix release. Apache does not expect to create one. Axis2/Java is a different engine; no source lists it as affected, and no source says it is not affected. A hand-applied patch needs its own change control.","verify":"Record that Axis 1.x jars are gone, or that the install is a custom build that includes commit 41f3b4e8, and that untrusted networks cannot reach leftover Axis 1.x SOAP listeners.","source":{"url":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436","date":"2026-11-13","publisher":"CSIRT Italia"}},{"title":"Disable N-central Legacy API","detail":"N-able (12 Nov 2026, via The Hacker News): disable Legacy API immediately if it is on. Legacy API is off by default and is not recommended. Hosted environments are not affected by this issue (vendor statement).","limits":"Does not patch Axis 1.x or the unpublished 4EverAble2Shell local escalation. HF2 2026.4.1.26 does not protect. On-prem customers still need the promised follow-up hotfix.","verify":"In the N-central admin UI, confirm Legacy API is off and that untrusted networks cannot complete a connection to the Legacy API listener.","source":{"url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","date":"2026-11-12","publisher":"The Hacker News"}},{"title":"Disable Confluence Remote API (XML-RPC and SOAP)","detail":"Atlassian: log in as an administrator, open General Configuration then Further Configuration, clear Remote API (XML-RPC and SOAP), and Save. The setting takes effect without a restart. Turning it off may stop scripts, automations, and third-party add-ons.","limits":"Not a substitute for 9.2.28. Does not apply to 10.x (feature removed) or Cloud. Atlassian: test in non-production first.","verify":"Browse to <base_url>/plugins/servlet/soap-axis1/confluenceservice-v2. Atlassian: HTTP 403 means the mitigation is on. A message about confluenceservice-v2 or AXIS service means re-check the steps.","source":{"url":"https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-1874560038.html","date":"2026-11-10","publisher":"Atlassian"}}],"updatedAt":"2026-11-14","addedDate":"2026-11-13"},"response":{"summary":"If an Axis 1.x SOAP endpoint, N-central Legacy API, or Confluence Remote API was reachable from 12 Nov 2026, treat that host as exposed. On N-central, Huntback's miner chain is a sourced compromise pattern. Contain, hunt the artefacts below, and keep evidence. Badge: Reported exploited (government: CSIRT Italia, 13 Nov 2026). Apache has published no exploitation statement.","containment":[{"title":"Take internet-exposed Axis SOAP and N-central Legacy API off untrusted networks","detail":"Firewall or disable the listener. N-able: disable Legacy API now. Atlassian: disable Remote API or patch to 9.2.28. Network limits are not an Axis 1.x software fix.","sources":[{"url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","date":"2026-11-12","publisher":"The Hacker News"},{"url":"https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-1874560038.html","date":"2026-11-10","publisher":"Atlassian"}]},{"title":"On N-central, hunt the Huntback miner chain before assuming a cleanup is enough","detail":"Huntback: treat a hit as a full compromise, not a cleanup job. 19 of 21 pool-listed hosts were already on HF2. Applying HF2 is not enough on its own.","sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"}]}],"rotate":[{"item":"Credentials and secrets readable by the application account (on N-central, nable and then root)","reason":"If Axis code ran, it ran as the embedding account. Huntback then describes local root. Rotate secrets and integration tokens on hosts that were reachable with Legacy API or Remote API on. Generic IR; Apache did not publish a credential list.","generic":true,"sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"}]},{"item":"N-central agent and customer remote-management sessions","reason":"Huntback: every N-central server holds remote-management access to the customers behind it. Review unexpected remote sessions and new scripts on managed endpoints. Generic IR beyond the miner payload Huntback saw.","generic":true,"sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"}]}],"persistence":[{"kind":"path","value":"/tmp/.xvd and /var/tmp/.xvd","detail":"Huntback miner working directories.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"kind":"service","value":"/etc/systemd/system/xvd.service","detail":"Huntback: systemd unit used to relaunch the miner.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"kind":"cron","value":"/etc/cron.d/xvd and crontab line tagged # xvkeep","detail":"Huntback: cron fallbacks if systemd cannot be written.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"kind":"path","value":"serverchild-*.bak / .sh / .out in /var/opt/n-central/tmp/ and a symlink at /var/opt/n-central/flag/flag_default.json","detail":"Huntback: leftover files from the nable-to-root helper. Presence is a lead.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"}],"observedBehaviour":[{"title":"XMRig-like miner with rig ID nc_","detail":"Huntback: the root payload installed a miner that reports rig IDs starting with nc_. Hunt command-line fragments --rig-id nc_, --donate-level 1, and --cpu-max-threads-hint. This page does not copy the installer or wallet.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"},{"title":"User-agents on the Axis stage","detail":"Huntback: weaponised requests used python-requests/2.31.0; checks used Mozilla/5.0.","sourceUrl":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","sourceDate":"2026-11-12"}],"evidence":[{"title":"Web and WAF logs covering Axis SOAP, N-central ServerUI, and Confluence soap-axis1","detail":"Keep POST bodies if you have them. A SOAP Fault with exceptionName is a lead, not proof of RCE.","sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/06/12","date":"2026-11-06","publisher":"oss-security / Apache"},{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"}]},{"title":"Host artefacts, process lists, and egress to the Huntback IOCs","detail":"Keep copies of .xvd trees, xvd.service, cron lines, flag_default.json, and NetFlow to 157.20.241[.]16 and the mining endpoints. Victim IPs were not published.","sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"}]},{"title":"Installed Axis, N-central, and Confluence versions from before changes","detail":"Keep jar versions, N-central build (including whether it was 2026.4.1.26), Confluence version, and Legacy API / Remote API settings.","sources":[{"url":"https://www.openwall.com/lists/oss-security/2026/11/06/12","date":"2026-11-06","publisher":"oss-security / Apache"}]}],"limits":["Huntback success is inferred from public pool shares, not host forensics.","Huntback does not cite CVE-2026-90436. Previdian and BleepingComputer make that link.","N-able says it has seen no signs of compromise. Badge stays Reported exploited.","This page does not copy wallet addresses, SOAP bodies, named Java classes, or installer commands.","No public exploitation report against Confluence or other embedders was found when checked 13 Nov 2026."],"sources":[{"url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","publisher":"Huntback"},{"url":"https://www.tenable.com/blog/able2shell-frequently-asked-questions-for-reported-n-able-n-central-zero-day-vulnerabilities","date":"2026-11-12","publisher":"Tenable"}],"updatedAt":"2026-11-14","addedDate":"2026-11-13"},"bulletins":[{"vendor":"Apache Axis","title":"CVE-2026-90436 oss-security advisory","url":"https://www.openwall.com/lists/oss-security/2026/11/06/12","date":"2026-11-06","cve":"CVE-2026-90436"},{"vendor":"Atlassian","title":"CVE-2026-90436 Remote Code Execution in Confluence Data Center","url":"https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-1874560038.html","date":"2026-11-10","cve":"CVE-2026-90436"},{"vendor":"CERT-FR","title":"CERTFR-2026-AVI-1492","url":"https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1492/","date":"2026-11-10","cve":"CVE-2026-90436"}],"coverage":[{"title":"Apache Axis: rilevato sfruttamento in rete della CVE-2026-90436 (AL02/261113/CSIRT-ITA)","publisher":"CSIRT Italia","url":"https://www.acn.gov.it/portale/w/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436","date":"2026-11-13","type":"government","addedDate":"2026-11-14"},{"title":"Apache Axis: rilevato sfruttamento in rete della CVE-2026-90436 (AL02/261113/CSIRT-ITA) (Toscana CSIRT mirror)","publisher":"CSIRT Toscana","url":"https://csirt.regione.toscana.it/apache-axis-rilevato-sfruttamento-in-rete-della-cve-2026-90436-al02-261113-csirt-ita/","date":"2026-11-13","type":"news","addedDate":"2026-11-14"},{"title":"N-central Critical Security Update (incident 202613)","publisher":"N-able","url":"https://uptime.n-able.com/event/202613/","date":"2026-11-12","type":"vendor","addedDate":"2026-11-13"},{"title":"Hackers Exploit New N-central Zero-Day Hours After PoC Publication","publisher":"SecurityWeek","url":"https://www.securityweek.com/hackers-exploit-new-n-central-zero-day-hours-after-poc-publication/","date":"2026-11-13","type":"news","addedDate":"2026-11-13"},{"title":"CVE-2026-90436: Apache Axis 1.x unauthenticated remote class instantiation","publisher":"oss-security / Apache","url":"https://www.openwall.com/lists/oss-security/2026/11/06/12","date":"2026-11-06","type":"vendor","addedDate":"2026-11-13"},{"title":"Apache mailing list thread","publisher":"Apache Software Foundation","url":"https://lists.apache.org/thread/8slf0j9gz35z56t0glt5h0ncwlbn4bdz","date":"2026-11-06","type":"vendor","addedDate":"2026-11-13"},{"title":"CVE-2026-90436","publisher":"Apache CNA / CVE.org","url":"https://www.cve.org/CVERecord?id=CVE-2026-90436","date":"2026-11-06","type":"vendor","addedDate":"2026-11-13"},{"title":"NVD CVE-2026-90436","publisher":"NIST NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90436","date":"2026-11-06","type":"government","addedDate":"2026-11-13"},{"title":"GHSA-988f-c54m-f8jj","publisher":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-988f-c54m-f8jj","date":"2026-11-06","type":"vendor","addedDate":"2026-11-13"},{"title":"CVE-2026-90436 - Remote Code Execution in Confluence Data Center","publisher":"Atlassian","url":"https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-1874560038.html","date":"2026-11-10","type":"vendor","addedDate":"2026-11-13"},{"title":"CERTFR-2026-AVI-1492","publisher":"CERT-FR","url":"https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1492/","date":"2026-11-10","type":"government","addedDate":"2026-11-13"},{"title":"N-central 4EverAble2Shell miners on live servers","publisher":"Huntback","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","date":"2026-11-12","type":"research","addedDate":"2026-11-13"},{"title":"New N-central exploits work against patched servers","publisher":"The Hacker News","url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","date":"2026-11-12","type":"news","addedDate":"2026-11-13"},{"title":"New N-able 4EverAble2Shell zero-day exploited hours after PoC released","publisher":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/new-n-able-4everable2shell-zero-day-exploited-hours-after-poc-released/","date":"2026-11-12","type":"news","addedDate":"2026-11-13"},{"title":"Able2Shell FAQ, N-able N-central zero-days and Hotfix 2","publisher":"Tenable","url":"https://www.tenable.com/blog/able2shell-frequently-asked-questions-for-reported-n-able-n-central-zero-day-vulnerabilities","date":"2026-11-12","type":"news","addedDate":"2026-11-13"},{"title":"CVE-2026-90436 Exploitation Attempts Observed","publisher":"Previdian","url":"https://previdian.com/CVE-2026-90436","date":"2026-11-12","type":"research","addedDate":"2026-11-13"},{"title":"OpenAdvisories CVE-2026-90436","publisher":"OpenAdvisories","url":"https://www.openadvisories.org/vuln/CVE-2026-90436","date":"2026-11-13","type":"news","addedDate":"2026-11-13"},{"title":"CISA KEV catalog JSON (CVE-2026-90436 not listed; catalog 2026.11.13)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-13","type":"government","addedDate":"2026-11-14"},{"title":"Brandefense ATLAS CVE-2026-90436","publisher":"Brandefense","url":"https://atlas.brandefense.io/vulnerability-intelligence/CVE-2026-90436","date":"2026-11-12","type":"news","addedDate":"2026-11-13"}],"posts":[],"research":[{"title":"N-central 4EverAble2Shell miners on live servers","url":"https://huntback.io/blog/ncentral-4everable2shell-miners-on-live-servers","authors":"Huntback","date":"12 Nov 2026"}],"impact":{"kind":"shared-component","component":"Apache Axis 1.x","matrixNote":"Axis 1.x is EOL. A product is exploitable only if it still ships Axis 1.x and exposes a SOAP endpoint, and RCE still needs a suitable class on that product's classpath. Do not read Axis2/Java, Confluence 10.x, or Confluence Cloud as a blanket not-affected mark for other embedders.","downstream":[{"product":"Apache Axis 1.x (Maven axis:axis and org.apache.axis:axis)","vendor":"Apache Software Foundation","type":"cms-app","notes":"Affected: all Apache Axis 1.x through 1.4. Git range aac718c6 up to but not including 41f3b4e8. Apache suggests Axis2/Java as a migration target, not as a patched 1.x line.","status":"eol-migrate","versions":"No Axis 1.x release. Unreleased commit 41f3b4e8, or migrate.","vendorStatement":{"date":"2026-11-06","url":"https://www.openwall.com/lists/oss-security/2026/11/06/12","quote":"The Apache Axis project does not expect to create an Axis 1.x release fixing this problem."},"statusLabel":"EOL / no 1.x release","addedDate":"2026-11-13"},{"product":"Apache Axis2/Java","vendor":"Apache Software Foundation","type":"cms-app","notes":"No source reviewed for this page says Axis2 is affected or not affected.","status":"no-statement-yet","vendorStatement":{"date":"Checked 13 Nov 2026","url":"https://www.openwall.com/lists/oss-security/2026/11/06/12","quote":"Apache recommends migrating to a different SOAP engine, such as Apache Axis 2/Java. That is a migration target, not a not-affected mark."},"statusLabel":"Not listed as affected","addedDate":"2026-11-13"},{"product":"N-able N-central on-premises","vendor":"N-able","type":"cms-app","notes":"N-able has not named CVE-2026-90436. Third-party reporting (Huntback, Previdian, BleepingComputer) describes Axis code execution as stage 1 of 4EverAble2Shell. Disable Legacy API now. 19 of Huntback's 21 pool-listed hosts reported HF2. See [Able2Shell](https://vuln2shell.com/vulns/able2shell-n-able-n-central) for the HF2 CVEs. Also: [uptime 202613](https://uptime.n-able.com/event/202613/).","status":"affected","versions":"No 4EverAble2Shell fix yet. HF2 2026.4.1.26 does not protect.","vendorStatement":{"date":"2026-11-12","url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","quote":"Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet."},"statusLabel":"No statement naming this CVE yet","addedDate":"2026-11-13"},{"product":"N-able N-central hosted (NCOD)","vendor":"N-able","type":"cloud-container-hosting","notes":"Vendor wording is about the 12 Nov N-central chain / Legacy API issue. N-able has not named CVE-2026-90436. Tenable FAQ: Intune integration disabled; no signs of compromise; follow-up hotfix promised.","status":"vendor-stated-not-affected","versions":"Not applicable for this 12 Nov issue (vendor statement)","vendorStatement":{"date":"2026-11-12","url":"https://thehackernews.com/2026/11/new-n-central-exploits-work-against.html","quote":"The company is urging customers to disable Legacy API immediately, if not already. It also noted that hosted environments are not affected by this issue."},"addedDate":"2026-11-13"},{"product":"Atlassian Confluence Data Center 1.x-9.x","vendor":"Atlassian","type":"cms-app","notes":"Atlassian CVSS 4.0 9.3. Mitigation: turn off Remote API. Ticket CONFSERVER-104610. Atlassian cannot confirm if your instances have been affected. No public exploitation report against Confluence was found when checked 13 Nov 2026.","status":"affected","versions":"9.2.28","vendorStatement":{"date":"2026-11-10","url":"https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-1874560038.html","quote":"To be vulnerable, the Confluence instance must have the Remote API (XML-RPC & SOAP) enabled. This setting was turned off by default for new installations starting in Confluence 3.0."},"addedDate":"2026-11-13"},{"product":"Atlassian Confluence Data Center 10.x","vendor":"Atlassian","type":"cms-app","status":"vendor-stated-not-affected","versions":"Not impacted (Remote API removed in 10.0)","vendorStatement":{"date":"2026-11-10","url":"https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-1874560038.html","quote":"Note that Confluence 10.x and above are not impacted. This feature was fully removed in Confluence 10.0."},"addedDate":"2026-11-13"},{"product":"Atlassian Confluence Cloud","vendor":"Atlassian","type":"cloud-container-hosting","status":"vendor-stated-not-affected","versions":"No action required","vendorStatement":{"date":"2026-11-10","url":"https://confluence.atlassian.com/security/cve-2026-90436-remote-code-execution-in-confluence-data-center-1874560038.html","quote":"This vulnerability has no impact on Atlassian Cloud sites, and no action is required. If your Confluence site is accessed via an atlassian.net or jira.com domain, it is securely hosted by Atlassian and not vulnerable to this issue."},"addedDate":"2026-11-13"},{"product":"Atlassian Bitbucket / Jira","vendor":"Atlassian","type":"cms-app","notes":"No CVE-2026-90436 advisory for Bitbucket or Jira on the Atlassian advisories list when checked 13 Nov 2026. Not a not-affected mark.","status":"no-statement-yet","vendorStatement":{"date":"Checked 13 Nov 2026","url":"https://www.atlassian.com/trust/security/advisories"},"addedDate":"2026-11-13"},{"product":"Debian 12/13/14 axis package","vendor":"Debian","type":"linux-distro","notes":"OpenAdvisories roll-up of the Debian security tracker, checked 13 Nov 2026. Not a Debian DSA.","status":"affected","versions":"No fix yet","vendorStatement":{"date":"Checked 13 Nov 2026","url":"https://www.openadvisories.org/vuln/CVE-2026-90436","quote":"Debian 14, 13, and 12 axis packages: No fix yet."},"addedDate":"2026-11-13"},{"product":"Ubuntu 16.04 through 26.10 axis package","vendor":"Canonical","type":"linux-distro","notes":"OpenAdvisories roll-up of the Ubuntu security tracker, checked 13 Nov 2026. Not a USN.","status":"affected","versions":"No fix yet","vendorStatement":{"date":"Checked 13 Nov 2026","url":"https://www.openadvisories.org/vuln/CVE-2026-90436","quote":"Ubuntu 26.10, 26.04 LTS, 24.04 LTS, 22.04 LTS, 20.04 LTS, Ubuntu Pro 18.04 LTS, and Ubuntu Pro 16.04 LTS axis packages: No fix yet."},"addedDate":"2026-11-13"},{"product":"Other historic Axis 1.x embedders (IBM, SAP, Oracle, VMware)","vendor":"Various","type":"cms-app","notes":"No CVE-2026-90436 vendor statement found when checked 13 Nov 2026. IBM has historic Axis 1.4 bulletins for Sterling B2B Integrator and Sterling Control Center on older CVEs only. Those are watch candidates, not a 90436 affected mark. Do not treat silence as not affected.","status":"no-statement-yet","vendorStatement":{"date":"Checked 13 Nov 2026","url":"https://www.openadvisories.org/vuln/CVE-2026-90436"},"addedDate":"2026-11-13"}]},"pocs":[{"title":"4EverAble2Shell researcher chain (for defenders)","url":"https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able","source":"Sean Bales","validationStatus":"unverified","validationDate":null,"listedDate":"2026-11-12","notes":"Public GitHub folder on Oracle-Security/CVEs (account later MSPNightmare). Huntback dates the add to 12 Nov 2026 03:58 UTC and the Legacy API requirement to 07:48 UTC. Status Unverified. No named vendor lab validation. Huntback and Previdian report real-world use of this chain. BleepingComputer: This attack chain matches the POC Bales released. CSIRT Italia AL02/261113 (13 Nov 2026) notes that a public PoC is available and adds no validation. Index link only; this site does not copy exploit code, SOAP bodies, named Java classes, or usage steps. A standalone Axis PoC by handle fixedbyreboot was listed on GitHub on 10 Nov 2026 14:45 SGT (Previdian timeline); Previdian and OpenAdvisories mark it unverified and note public PoCs can contain malware. That repo is not linked here. OpenAdvisories 13 Nov 2026: no Metasploit module and no Exploit-DB entry. VulnCheck unknown (login wall).","addedDate":"2026-11-13"}],"pocEmptyState":"Public researcher chain is indexed as Unverified. This site does not copy exploit code.","_feed":{"page":"https://vuln2shell.com/vulns/apache-axis-cve-2026-90436","json":"https://vuln2shell.com/vulns/apache-axis-cve-2026-90436.json","iocsCsv":"https://vuln2shell.com/vulns/apache-axis-cve-2026-90436/iocs.csv","stix":"https://vuln2shell.com/vulns/apache-axis-cve-2026-90436/stix.json","badges":{"patch":"Partly patched","itw":"Reported exploited","poc":"Public PoC (unverified RCE)"}}}