N-able released a fourth N-central hotfix for a CVSS 10 flaw that could let an unauthenticated attacker run code. NHS England reports possible zero-day exploitation, while N-able says production exploitation is not confirmed.
A malicious website could ask the N-able Passportal browser extension for authentication tokens and receive enough access to enumerate, decrypt and modify credentials across a password vault. The vulnerable extension did not require the attacker to compromise N-able, the managed…
Microsoft has identified a new ransomware strain deployed by China-linked Storm-1175. The campaign coincides with active exploitation of N-able N-central, although the specific entry route remains unconfirmed.
