Attackers Are Exploiting SimpleHelp: CVSS 10 Auth Bypass in the Wild

CVE-2026-48558 is a CVSS 10.0 authentication bypass in SimpleHelp that lets an unauthenticated remote attacker forge an OIDC identity token and obtain a fully authenticated technician session, with the potential to bypass multi-factor authentication in the process. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on June 29, 2026, with a federal remediation deadline of July 2, 2026.

Am I affected?

The following builds are vulnerable (from the SimpleHelp security advisory):

• SimpleHelp 5.5.15 and all earlier versions
• SimpleHelp 6.0 pre-release builds (prior to RC2)

The bypass activates only when OIDC authentication is configured on the server. Servers running local authentication only are not directly exposed to the token-forgery path. SimpleHelp recommends patching regardless of OIDC configuration.

What to do now

Patch immediately. SimpleHelp released fixed builds on May 26, 2026:

• Upgrade to SimpleHelp 5.5.16
• Upgrade to SimpleHelp 6.0 RC2

Both are available through SimpleHelp’s SimpleSetup automated update system and the vendor download page. The CISA KEV due date of July 2, 2026 applies to federal agencies under BOD 26-04; all organizations should treat it as an equally urgent deadline.

If you cannot patch right now:

1. Disable OIDC authentication on the SimpleHelp server until the patch is applied. This removes the vulnerable code path entirely.
2. Restrict network access to the SimpleHelp administration interface and technician login portal to known IP ranges.
3. Review the technician list in Administration > Technicians for any accounts you did not create.

How it is being exploited

CISA’s KEV listing on June 29, 2026 confirms in-the-wild exploitation. Known ransomware campaign use is listed as Unknown at this time.

The attack requires no prior credentials. An attacker sends a crafted OIDC identity token to the login endpoint. Because SimpleHelp does not verify the token’s cryptographic signature (CWE-347: Improper Verification of Cryptographic Signature), the server accepts the forged identity claims and opens a live technician session. From that position, an attacker can register additional technician accounts, modify server configuration, or connect to managed endpoints.

The vulnerability was discovered and responsibly disclosed in May 2026, with patches shipping from the vendor on May 26, 2026 and public disclosure following on June 12, 2026.

Log entries to review for signs of unauthorized access:

• Unexpected “Registering technician login” entries in /opt/SimpleHelp/logs/server.log for names or emails you do not recognize
• “Configuration save requested” events from unrecognized accounts

How VulnMonitor helps

If SimpleHelp appears in your asset inventory, VulnMonitor correlates the CVE-2026-48558 KEV entry against it and puts it at the top of your risk queue. EPSS for this CVE is 0.72% (49th percentile as of June 29, 2026); that number will move now that exploitation is confirmed, but CISA KEV status already overrides the probabilistic signal. If you are on an affected build, the clock is running.

Updates

• 2026-06-30 Initial post. CVE-2026-48558 added to CISA KEV on 2026-06-29. CVSS 3.1: 10.0, EPSS 0.72% (49th percentile). Federal due date 2026-07-02. Fixed in SimpleHelp 5.5.16 and 6.0 RC2.