Key facts
- N-able said its hosted N-Central service is offline while it secures environments and implements remediation.
- N-able urged customers to take down self-hosted N-Central deployments, citing risk from the public exploits.
- Researcher Ben Bales released the bugs on GitHub on Sunday and called them Able2Shell.
- Bales described the bugs as able to steal credentials, create admin accounts and gain root access.
- N-able said it has no evidence of successful exploitation against customer environments.
Remote access company N-able said it took its cloud-hosted N-Central offering offline to fix security vulnerabilities that were published online, according to a status update on its website. N-Central lets corporate customers remotely access and manage other devices and systems on the same network.
The company said the hosted service is offline "while we take the necessary actions to secure the environments and implement appropriate remediation." It also urged customers to take down their own self-hosted deployments of N-Central, warning that attackers could use the publicly disclosed exploits to break into customer networks.
Security researcher Ben Bales released the bugs on GitHub on Sunday. In a post on X, Bales called them Able2Shell and described them as a mix of vulnerabilities that can steal credentials, create new administrative accounts and gain root access to affected N-able systems. Bales told Bleeping Computer he released the bugs publicly because the company allegedly failed to patch flaws reported in a different product.
N-able said it has no evidence of successful exploitation against any of its customer environments. A spokesperson did not respond to a request for comment about whether the company can check, such as through server logs, or has no way to check.