aviatrix logoAviatrix
Under Active Attack

Executive Summary

In July 2026, security researcher James Arnott discovered a critical vulnerability in N-able's Passportal password manager that allowed any malicious website to steal complete vault access tokens and master keys. The flaw affected approximately 2,500 managed service providers (MSPs) and 165,000 small and medium-sized businesses using the cloud-based credential management system. Attackers could compromise all stored passwords, time-based one-time passwords (TOTPs), and maintain persistent access for up to 100 days through stolen refresh tokens. N-able patched the vulnerability within 24 hours, but the underlying cloud-based architecture continues to expose users to supply chain risks.

This incident highlights the growing risks of cloud-based password managers in an era where supply chain attacks targeting MSPs have become increasingly sophisticated, making credential security architecture choices more critical than ever for organizations managing downstream client access.

Why This Matters Now

With MSPs increasingly targeted by nation-state actors and ransomware groups, cloud-based password managers create amplified supply chain risks where a single compromise can cascade across hundreds of downstream organizations, making architectural security decisions business-critical.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Implementing end-to-end encryption with client-side decryption and proper origin validation for browser extension messages would have prevented this compromise.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have constrained this N-able Passportal supply chain attack by limiting lateral movement between MSP and client environments and reducing the scope of credential exfiltration through segmented cloud access controls.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Cloud-native workload isolation would likely have limited the blast radius of compromised tokens by restricting which cloud services and resources the stolen credentials could access

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Identity-aware segmentation policies would likely have constrained the escalation path by limiting which privileged services compromised tokens could reach within the cloud environment

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely have constrained lateral movement between MSP and client network segments by enforcing identity verification for cross-environment access attempts

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Continuous visibility and policy enforcement would likely have detected and constrained the persistent token refresh patterns across cloud services over the extended 100-day period

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress policy enforcement would likely have constrained large-scale vault data extraction by limiting outbound data flows and requiring additional authorization for bulk credential transfers

Impact (Mitigations)

Even with constrained lateral movement and reduced credential exposure, remaining compromised assets would still pose supply chain risks to downstream clients, though with significantly limited blast radius

Impact at a Glance

Affected Business Functions

  • Managed Service Provider Operations
  • Password and Credential Management
  • Client IT Infrastructure Management
  • Multi-tenant Security Services
Operational Disruption

Estimated downtime: 1 days

Financial Impact

Estimated loss: N/A

Data Exposure

Complete exposure of password vaults for approximately 2,500 MSPs and 165,000 SMBs, including all stored credentials, access tokens, refresh tokens, and time-based one-time passwords (TOTPs). The supply chain nature means compromise of one MSP could expose credentials for all their downstream clients, potentially affecting hundreds of organizations per compromised MSP.

Recommended Actions

  • • Implement Zero Trust segmentation to isolate MSP management planes from client environments and prevent lateral movement through trust relationships
  • • Deploy egress security controls with FQDN filtering to detect and block unauthorized data exfiltration from password management services
  • • Establish multicloud visibility to monitor anomalous authentication patterns and token usage across cloud-based credential management platforms
  • • Enable encrypted traffic inspection for high-performance monitoring of password manager communications and token exchanges
  • • Implement threat detection with behavioral baselining to identify suspicious access patterns and extended session durations in credential management systems

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image