It appears another (there have been many the past months) CRITICAL "zero auth" attack for N-Able dropped over the weekend, and N-Able has no response other than "Shut it down and await further instructions" today.
Sorry for linking to poison site, but it's the only place they have a public visible mention of it. Nothing on their site, not even logged in.
https://old.reddit.com/r/Nable/comments/1xrspdf/important_ncentral_critical_security_incident/
I know we're in the age of AI ruining absolutely everything, but the last few months of them calling us ON THE PHONE to insist we patch RIGHT NOW, TODAY leading up to WE HAVE NO PATCH, SHUT IT DOWN is my "last straw" with this company.
Will edit this post when/if I hear back. We're what- 6 hours in as a paying customer and they're full radio silence outside of the email telling us to shut 'er down.
edited again: 8 hours later, absolute radio silence. If you have NABL stock, (not a financial advisor) I suggest you dump it first thing in the morning.
Here are the published vulnerabilities, published 15 hours ago: https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able
N-Able status page is saying it's "public disclosure and non-responsible communication of critical vulnerabilities" but according to the GitHub repo author
It's pretty much he said, she said, but the repo author has no reason to lie about this while the corporate has plenty of reasons...
https://www.bleepingcomputer.com/news/security/n-able-takes-cloud-platform-offline-after-30-plus-zero-days-published/
Fuckass.
Nailed it RIGHT on the head.