Security Advisory: N-able Integration Paused

We are continuing to monitor for any further issues.

Following <a href=https://uptime.n-able.com/event/202613/>N-able’s disclosure of a critical vulnerability</a> earlier this week, we temporarily inactivated Autotask and IT Glue API users tied to N-able integrations. These steps mirror N-able’s containment measures and protect credentials stored in N-able environments.

If you use the N-able integration with BMS, we recommend disabling it as well until you’ve completed the remediation steps in <a href="https://uptime.n-able.com/event/202580/">N-able’s advisory</a>.

We have no reason to believe Autotask, IT Glue, BMS or Kaseya systems were accessed. Only customers using an N-able integration with these products are affected.

<b>To restore your Autotask integration:</b>

- Complete the remediation in <a href="https://uptime.n-able.com/event/202580/">N-able’s advisory</a> for your environment.
- Have a System Admin reactivate the associated API user in Autotask; see this <a href=https://help.vsa10.kaseya.com/help/Content/1-Modules/integrations/autotask.htm>Autotask Integration KB</a> for reference.

<b>To restore your IT Glue integration:</b>

- Complete the remediation in<a href="https://uptime.n-able.com/event/202580/"> N-able’s advisory</a> for your environment
- Once the N-able remediation steps have been followed, proceed to this ITG KB under the section - <a href=https://help.itglue.kaseya.com/help/Content/1-admin/it-glue-api/getting-started-with-the-it-glue-api.html>Restart a paused API key </a>

<b>Disable your BMS N-able integration:</b>

- We recommend disabling the BMS API key for APIs that utilize N-able.
- Complete the remediation in <a href="https://uptime.n-able.com/event/202580/">N-able’s advisory</a> for your environment.
- Once the N-able remediation steps have been followed, proceed to this BMS KB under section - <a href=https://help.itglue.kaseya.com/help/Content/1-admin/psa-integrations/integrating-with-kaseya-bms.html?Highlight=bms%20api>Enable or Disable Sync</a>

We haven’t changed API keys or secrets, and rotation isn’t currently required. We’ll be updating this thread as more information comes through. For additional questions, please contact our <a href="https://helpdesk.kaseya.com/hc/en-gb">Kaseya Support</a> team.