Remote access provider N-able has taken its cloud-hosted N-Central platform offline after security researcher Ben Bales published several zero-day vulnerabilities online without prior notice. The company said it is working to secure affected environments and urged customers to disable self-hosted deployments as well, warning that the disclosed flaws could let attackers gain access to customer networks.
N-able’s N-Central service allows companies to remotely manage devices and systems within their networks, making it a valuable target for hackers. The vulnerabilities, named Able2Shell by Bales, include exploits capable of stealing credentials, creating new administrative accounts, and obtaining root access. Bales released the bugs publicly, claiming N-able had not addressed similar flaws in another product.
While N-able stated it has not seen evidence of successful attacks, it did not clarify whether it can verify this through logs or other means. The lack of advance notice and the extent of the vulnerabilities have led to a full service suspension, affecting business continuity for many customers.
Executives in regulated sectors should assess their reliance on remote access tools and review incident response plans. Monitoring for further updates from N-able and evaluating alternative solutions may be prudent.
