N-able has taken its remote access service offline and told customers who run the software themselves to shut down their servers, after a researcher published dozens of zero-day bugs.
A zero-day is a security flaw that attackers can use before the vendor has shipped a fix. Publishing dozens at once gives anyone who reads the disclosure a head start. N-able called the situation a "critical security incident" and said it feared the possibility of cyberattacks. Its response covers two groups: users of its own hosted service, which the company switched off, and self-hosted customers, who manage their own servers and were asked to take them down.
The stakes come from what this kind of software does. Remote access tools exist to give an operator control over other machines, so a weakness in one can become a way into every system it manages. That matters most for vendors that sell to IT providers, because one compromised tool can reach the customers behind them.
There is precedent. In 2021, attackers used Kaseya's VSA remote management software to push ransomware to businesses downstream of the managed service providers that ran it. In 2024, flaws in ConnectWise's ScreenConnect were exploited soon after they became public.
N-able's stated worry is the possibility of attacks, not confirmed ones. Still, a remote access product is only useful when people can reach it, so switching it off is an expensive way to buy time.