Remote access company N-able confirmed that, following the public disclosure of a series of security vulnerabilities this week, it took its cloud-hosted products offline to apply patches, as the company was not given advance notice before the vulnerabilities were made public.
In its official status update, the company stated that its customer-facing managed version of N-Central is currently offline, stating, “We are taking necessary measures to secure the affected environment and implement appropriate remediation.” The company also urged customers to shut down their self-hosted N-Central deployments due to concerns that attackers may exploit the publicly disclosed vulnerabilities to compromise customer networks.
N-able states that during this period, customers will be unable to use the N-Central service, which enables enterprise customers to remotely access and manage other devices and systems on the same network. Remote access technologies are frequently targeted by hackers because such systems may grant attackers extensive access to a company’s network and internal data.
Security researcher Ben Bales disclosed these "zero-day" vulnerabilities on GitHub on Sunday. Bales referred to this set of vulnerabilities as Able2Shell on X, describing them as a combination of exploitable flaws that can steal credentials, create new administrator accounts, and gain root access to affected N-able systems.
Bales told Bleeping Computer that he disclosed these vulnerabilities because the company allegedly failed to patch flaws he previously reported in another product.
N-able stated that there is no evidence that any customer environment has been successfully compromised. The company did not respond to requests for comment on whether it has the ability to investigate, such as reviewing server logs, or whether such investigation is fundamentally impossible.