CVE-2026-48558

SimpleHelp is an RMM tool used to manage computers for your clients (and sometimes your own). This bug means the login system can be tricked: an attacker can send fake “proof of identity” and SimpleHelp accepts it, so the attacker can act as a fully logged-in technician. In practice, this can let attackers use your RMM access to push malware or steal credentials from affected computers.

This matters if you run SimpleHelp and use its OIDC authentication (OIDC is configured). It is a remote, unauthenticated problem—attackers do not need a login or user interaction—so exposure depends on whether SimpleHelp can be reached by attackers over the network. If SimpleHelp is reachable from the internet or otherwise reachable by an attacker, treat this as an immediate risk; otherwise the risk may be lower but is still serious once internet/reachable exposure is possible.

This is RED because confirmed real-world exploitation is reported and CISA listed it in the KEV catalog. Attackers are using this authentication bypass to compromise systems by dropping Djinn Stealer malware, meaning the window for action is very short. CISA requires mitigation according to vendor instructions by 2026-07-02.