N-able takes its remote access service offline after researcher publishes dozens of zero-day bugs

Remote access company N-able has confirmed it took down its cloud-hosted offering to fix a slew of security vulnerabilities that were published online this week, giving the company no advance notice to fix them.

In a status update on its website, the company said its hosted N-Central offering for customers is now offline “while we take the necessary actions to secure the environments and implement appropriate remediation.” The company also urged customers to take down their own self-hosted deployments of N-Central, fearing that attackers could use the publicly disclosed exploits to hack into customer networks.

N-able said during this time customers will not be able to use their N-Central service, which allows corporate customers to remotely access and manage other devices and systems on the same network. Remote access technologies are a frequent target of hackers, as these systems can grant vast access to a company’s network and internal data.

Security researcher Ben Bales released the “zero-day” bugs on GitHub on Sunday. In a post on X, Bales dubbed the bugs Able2Shell, describing them as a mix of vulnerabilities capable of stealing credentials, creating new administrative accounts, and gaining root access to affected N-able systems.

Bales told Bleeping Computer that he publicly released the bugs as the company allegedly failed to patch the flaws reported in a different product.

N-able said that it has no evidence of successful exploitation against any of its customer environments. A spokesperson for the company did not respond to a request for comment about whether it has the ability to check, such as server logs, or if it has no way to check.