Security Advisory: N-able Integration Paused

We are continuing to monitor for any further issues.

Following N-able’s disclosure of a critical vulnerability earlier this week, we temporarily inactivated Autotask and IT Glue API users tied to N-able integrations. These steps mirror N-able’s containment measures and protect credentials stored in N-able environments.

If you use the N-able integration with BMS, we recommend disabling it as well until you’ve completed the remediation steps in N-able’s advisory.

We have no reason to believe Autotask, IT Glue, BMS or Kaseya systems were accessed. Only customers using an N-able integration with these products are affected.

To restore your Autotask integration:

- Complete the remediation in N-able’s advisory for your environment.
- Have a System Admin reactivate the associated API user in Autotask; see this Autotask Integration KB for reference.

To restore your IT Glue integration:

- Complete the remediation in N-able’s advisory for your environment
- Once the N-able remediation steps have been followed, proceed to this ITG KB under the section - Restart a paused API key

Disable your BMS N-able integration:

- We recommend disabling the BMS API key for APIs that utilize N-able.
- Complete the remediation in N-able’s advisory for your environment.
- Once the N-able remediation steps have been followed, proceed to this BMS KB under section - Enable or Disable Sync

We haven’t changed API keys or secrets, and rotation isn’t currently required. We’ll be updating this thread as more information comes through. For additional questions, please contact our Kaseya Support team.