Remote access to the company N-able confirmed that after a series of security vulnerabilities were released online this week, the company has taken its cloud hosting products offline for repairs. These vulnerabilities did not give the company any time in advance to fix them before they were made public.

The company stated in an update on its official website that its customer-facing managed version N-Central is currently offline. "We are taking necessary measures to protect the relevant environments and implementing appropriate repair plans," the company said. The company also urged customers to shut down their own self-managed N-Central deployments, as they are concerned that attackers may exploit these publicly disclosed vulnerabilities to invade customers' networks.

N-able indicates that during this period, customers will not be able to use the N-Central service. This service allows corporate customers to remotely access and manage other devices and systems within the same network. Remote access technology often becomes a target for hacker attacks, as such systems may grant attackers extensive access to the company's network and internal data.

Security researcher Ben Bales disclosed these "zero-day" vulnerabilities on GitHub on Sunday. Bales posted on X, referring to this set of vulnerabilities as Able2Shell, and described them as a group of vulnerabilities that can be exploited in combination to steal credentials, create new administrator accounts, and gain root privileges on the affected N-able systems.

Bales to Bleeping Computer indicates that the reason he made these vulnerabilities public is because the company allegedly failed to fix a defect he had previously reported in another product.

N-able indicates that there is no evidence to suggest that any customer environments have been successfully exploited. As for whether the company has the capability to conduct verifications, such as whether they can access server logs or whether it is simply impossible to verify at all, N-able the spokesperson did not respond to requests for comment.