CISA flags exploited SimpleHelp flaw that lets attackers forge technician logins

On June 29, 2026, CISA added CVE-2026-48558, a critical authentication bypass in the SimpleHelp remote support and RMM tool, to its Known Exploited Vulnerabilities catalog. The flaw carries a CVSS score of 10.0. When OpenID Connect (OIDC) login is enabled, SimpleHelp does not verify the signature on identity tokens, so a remote attacker can forge one and get a full technician session, in some configurations bypassing multifactor authentication. Security Affairs reports that the affected versions are SimpleHelp 5.5.15 and earlier and the 6.0 pre-release builds, and that security firm BlackPoint first observed attacks, including one that led to two malware samples.

SimpleHelp is widely used by IT providers to reach client machines. A technician session on the server can push scripts and files to managed endpoints. Exposed SimpleHelp servers grew from about 3,400 to nearly 14,000 since January 2025, according to the same report, and about 7.2% were reportedly set up with the vulnerable OIDC method.

Ask your IT provider whether they, or any vendor that supports you, use SimpleHelp. If so, confirm that the server is updated, whether OIDC login is enabled, and whether they have checked the published indicators of compromise. CISA's deadline for federal agencies to fix the flaw was July 2, which shows how quickly it expects action.

CISA also added two older SimpleHelp flaws to the catalog in April. Any remote access tool you rely on should be on a short patch cycle and kept off the open internet where possible.