The popular "Passportal" password manager, favored by MSPs and SMBs, remains risky even after its patch, thanks to its cloud-based design. Should these products stay away from the cloud entirely?
August 20, 2026
Unwise design choices from a specialty password manager allowed any malicious website to obtain complete, persistent access to customers' vaults.
"Passportal" is a credential management product from N-able, formerly SolarWinds MSP, a now-independent and nearly billion-dollar public company. N-able markets its products primarily to managed service providers (MSPs) and IT services providers, and according to its website, Passportal is used by around 2,500 managed service providers (MSPs) and 165,000 small and medium-sized businesses (SMBs).
Those organizations should be wary, though, because since their password manager operates over the cloud, their ultra-sensitive secrets are potentially vulnerable to Web-based exploits. On July 8, Bay Area Labs founder James Arnott discovered that Passportal accounts — and all of the credentials they manage — can be completely compromised by any website the user visits. The vendor implemented a patch the next day, but even the updated product carries some risk for users, Arnott tells Dark Reading.
