Loading story…
SimpleHelp released fixes for three critical vulnerabilities in its remote support and RMM software that can be chained to gain full control of vulnerable servers. The flaws are tracked as CVE-2024-57726, an authorization weakness that allows privilege escalation to administrator; CVE-2024-57727, an unauthenticated arbitrary file download issue that can expose sensitive data and credentials; and CVE-2024-57728, an authenticated administrator file upload flaw that can lead to remote code execution. Horizon3.ai disclosed the issues, and affected versions include SimpleHelp 5.5 before 5.5.8, 5.4 before 5.4.10, and 5.3 before 5.3.9.
CSIRT.SK reported that attackers have already targeted exposed SimpleHelp RMM systems, with Arctic Wolf observing intrusions in which threat actors used leaked credentials or exploited the vulnerabilities for initial access and compromise. The vendor urged organizations to patch immediately, rotate administrator and technician passwords, and restrict those account logins to trusted IP addresses to reduce the risk of server takeover and downstream compromise of managed endpoints.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
An update dated 2025-01-30 reported that Arctic Wolf had observed attacks against SimpleHelp RMM systems. According to the report, attackers used leaked credentials or exploited the three SimpleHelp CVEs for initial access and compromise.
SimpleHelp released security updates addressing three critical flaws in its remote access and RMM software: CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728. The affected versions were 5.5 before 5.5.8, 5.4 before 5.4.10, and 5.3 before 5.3.9.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecsirt.sk
Open sourcehorizon3.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-48558**, a maximum-severity authentication bypass in SimpleHelp remote management software that allows unauthenticated attackers to forge OpenID Connect identity tokens and log in as a technician. The flaw affects SimpleHelp `5.5.15` and earlier, along with `6.0` pre-release versions, because the OIDC login flow accepts submitted JWT identity tokens without verifying their cryptographic signature. The issue is rated `CVSS 10.0` and mapped to `CWE-347`, with no user interaction required for exploitation. Successful exploitation can give attackers an authenticated technician session with administrative reach into managed environments, including remote access to endpoints, script execution, and in some cases **MFA bypass** because technician accounts can enroll their own MFA method at first login. Horizon3.ai said the bug affects deployments using generic OIDC and Azure Active Directory OIDC, and estimated that internet-exposed SimpleHelp servers have grown to nearly **14,000**, with about **7.2%** using the vulnerable configuration. Defenders were urged to apply vendor patches immediately, restrict technician authentication by IP where patching is delayed, and review technician accounts and server logs for signs of compromise.
Jul 2, 2026
Attackers are actively exploiting **CVE-2026-48558**, a maximum-severity authentication bypass in **SimpleHelp** RMM, to forge OpenID Connect identity tokens and obtain fully authenticated **technician sessions** on exposed servers. The flaw affects deployments using generic OIDC or Azure AD OIDC because SimpleHelp accepted identity tokens without validating their cryptographic signatures, enabling unauthenticated access and, in some cases, bypass of MFA during technician enrollment. The issue affects **SimpleHelp 5.5.1 through 5.5.15** and **6.0 pre-release builds before 6.0 RC2**, and has been patched in **5.5.16+** and **6.0 RC2+**. In observed intrusions, attackers abused the trusted RMM channel to transfer files and execute commands across managed endpoints, deploying the obfuscated **TaskWeaver** Node.js loader followed by the newly identified **Djinn Stealer** malware. Reporting says TaskWeaver fetched additional payloads and used encrypted communications, while Djinn Stealer harvested credentials and sensitive data from browsers, cloud platforms, developer and package registry tooling, SSH environments, AI tools, and cryptocurrency wallets across **Windows, macOS, and Linux** before exfiltration. **CISA** added the flaw to its **Known Exploited Vulnerabilities** catalog, and sector alerts warned that compromise of a SimpleHelp server could give attackers downstream access across MSP and utility environments, increasing the risk of lateral movement, credential theft, and ransomware deployment.
Jul 6, 2026
Attackers are actively exploiting **CVE-2026-48558**, a critical OIDC authentication bypass in the SimpleHelp remote monitoring and management platform, to gain technician-level access to internet-facing servers without valid credentials. Investigators found the intrusions used the trusted RMM channel to deploy **TaskWeaver**, a heavily obfuscated JavaScript/Node.js loader that established encrypted communications with attacker infrastructure and fetched a second-stage payload known as **Djinn Stealer**. Blackpoint Cyber said its disclosure of active exploitation prompted CISA to add the flaw to the **Known Exploited Vulnerabilities** catalog. Once deployed, Djinn Stealer harvested high-value secrets from Windows, macOS, and Linux systems, including cloud credentials, SSH keys, API keys, service account credentials, browser data, source-control and package-registry tokens, cryptocurrency wallets, and credentials tied to AI development tools. Researchers said the malware encrypted stolen data with **AES-256-GCM** and protected the encryption key with **RSA-2048** before exfiltration, while the campaign appeared to rely on opportunistic scanning for exposed vulnerable SimpleHelp instances rather than tightly targeted victim selection. The activity raises particular concern for MSPs and enterprises because a compromise of trusted RMM infrastructure can extend quickly into cloud, CI/CD, and software supply chain environments.
Aug 11, 2026