Loading story…
Researchers disclosed CVE-2026-48558, a maximum-severity authentication bypass in SimpleHelp remote management software that allows unauthenticated attackers to forge OpenID Connect identity tokens and log in as a technician. The flaw affects SimpleHelp 5.5.15 and earlier, along with 6.0 pre-release versions, because the OIDC login flow accepts submitted JWT identity tokens without verifying their cryptographic signature. The issue is rated CVSS 10.0 and mapped to CWE-347, with no user interaction required for exploitation.
Successful exploitation can give attackers an authenticated technician session with administrative reach into managed environments, including remote access to endpoints, script execution, and in some cases MFA bypass because technician accounts can enroll their own MFA method at first login. Horizon3.ai said the bug affects deployments using generic OIDC and Azure Active Directory OIDC, and estimated that internet-exposed SimpleHelp servers have grown to nearly 14,000, with about 7.2% using the vulnerable configuration. Defenders were urged to apply vendor patches immediately, restrict technician authentication by IP where patching is delayed, and review technician accounts and server logs for signs of compromise.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
After adding CVE-2026-48558 to the Known Exploited Vulnerabilities catalog, CISA directed U.S. federal civilian agencies to remediate the SimpleHelp flaw by 2026-07-02. The order followed evidence of active exploitation in the wild.
CISA added CVE-2026-48558, the SimpleHelp OIDC authentication bypass flaw, to its Known Exploited Vulnerabilities catalog, reflecting active exploitation concern. The listing elevated urgency for organizations using SimpleHelp, particularly MSPs, to remediate and review exposure.
By 2026-06-29, attackers were reported actively exploiting CVE-2026-48558 on internet-facing SimpleHelp servers to create privileged access and use the platform as a trusted channel into managed systems. Blackpoint linked the intrusions to delivery of the newly identified TaskWeaver malware and Djinn Stealer, which targets credentials, cloud secrets, developer tooling, and cryptocurrency wallets across Windows, macOS, and Linux.
Researchers disclosed CVE-2026-48558, a maximum-severity authentication bypass in SimpleHelp affecting versions 5.5.15 and earlier and 6.0 pre-release versions. The flaw allows unauthenticated attackers to forge OIDC identity tokens without signature verification and obtain an authenticated technician session, with possible MFA bypass in some cases.
SimpleHelp released fixes for CVE-2026-48558 on 2026-06-09 in versions 5.5.16 and 6.0RC2. The patch addressed an OIDC authentication flaw that could let unauthenticated attackers create privileged Technician accounts and potentially bypass MFA.
According to the Canadian Centre for Cyber Security advisory, SimpleHelp published a security update on 2026-05-26 for vulnerabilities affecting versions 5.5.0 through before 5.5.16 and 6.0 through before 6.0 RC2. The notice directs users and administrators to review the vendor advisories and apply the update.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
16 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcecyber.gc.ca
Open sourcethecyberthrone.in
Open sourcesecurityonline.info
Open sourcehorizon3.ai
Open sourcecve.org
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-48558**, a maximum-severity authentication bypass in **SimpleHelp** RMM, to forge OpenID Connect identity tokens and obtain fully authenticated **technician sessions** on exposed servers. The flaw affects deployments using generic OIDC or Azure AD OIDC because SimpleHelp accepted identity tokens without validating their cryptographic signatures, enabling unauthenticated access and, in some cases, bypass of MFA during technician enrollment. The issue affects **SimpleHelp 5.5.1 through 5.5.15** and **6.0 pre-release builds before 6.0 RC2**, and has been patched in **5.5.16+** and **6.0 RC2+**. In observed intrusions, attackers abused the trusted RMM channel to transfer files and execute commands across managed endpoints, deploying the obfuscated **TaskWeaver** Node.js loader followed by the newly identified **Djinn Stealer** malware. Reporting says TaskWeaver fetched additional payloads and used encrypted communications, while Djinn Stealer harvested credentials and sensitive data from browsers, cloud platforms, developer and package registry tooling, SSH environments, AI tools, and cryptocurrency wallets across **Windows, macOS, and Linux** before exfiltration. **CISA** added the flaw to its **Known Exploited Vulnerabilities** catalog, and sector alerts warned that compromise of a SimpleHelp server could give attackers downstream access across MSP and utility environments, increasing the risk of lateral movement, credential theft, and ransomware deployment.
Jul 6, 2026
SimpleHelp released fixes for three **critical** vulnerabilities in its remote support and RMM software that can be chained to gain full control of vulnerable servers. The flaws are tracked as `CVE-2024-57726`, an authorization weakness that allows privilege escalation to administrator; `CVE-2024-57727`, an unauthenticated arbitrary file download issue that can expose sensitive data and credentials; and `CVE-2024-57728`, an authenticated administrator file upload flaw that can lead to remote code execution. Horizon3.ai disclosed the issues, and affected versions include SimpleHelp `5.5` before `5.5.8`, `5.4` before `5.4.10`, and `5.3` before `5.3.9`. CSIRT.SK reported that attackers have already targeted exposed SimpleHelp RMM systems, with Arctic Wolf observing intrusions in which threat actors used leaked credentials or exploited the vulnerabilities for initial access and compromise. The vendor urged organizations to patch immediately, rotate administrator and technician passwords, and restrict those account logins to trusted IP addresses to reduce the risk of server takeover and downstream compromise of managed endpoints.
Jul 24, 2026
Attackers are actively exploiting **CVE-2026-48558**, a critical OIDC authentication bypass in the SimpleHelp remote monitoring and management platform, to gain technician-level access to internet-facing servers without valid credentials. Investigators found the intrusions used the trusted RMM channel to deploy **TaskWeaver**, a heavily obfuscated JavaScript/Node.js loader that established encrypted communications with attacker infrastructure and fetched a second-stage payload known as **Djinn Stealer**. Blackpoint Cyber said its disclosure of active exploitation prompted CISA to add the flaw to the **Known Exploited Vulnerabilities** catalog. Once deployed, Djinn Stealer harvested high-value secrets from Windows, macOS, and Linux systems, including cloud credentials, SSH keys, API keys, service account credentials, browser data, source-control and package-registry tokens, cryptocurrency wallets, and credentials tied to AI development tools. Researchers said the malware encrypted stolen data with **AES-256-GCM** and protected the encryption key with **RSA-2048** before exfiltration, while the campaign appeared to rely on opportunistic scanning for exposed vulnerable SimpleHelp instances rather than tightly targeted victim selection. The activity raises particular concern for MSPs and enterprises because a compromise of trusted RMM infrastructure can extend quickly into cloud, CI/CD, and software supply chain environments.
Aug 11, 2026