CVE-2026-48558Active Exploitation(simple-help / simplehelp)

CRITICALCVSS 9.5 · CRITICALCISA KEV

Exploitation observed; activity peaked at 47 mentions and remains active

Immediate actions

Patch simple-help simplehelp systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.

simple-help CVEs Back to dashboard

8.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-07-02. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Patch / fix

https://simple-help.com/security/simplehelp-security-update-2026-05

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-347

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

simplehelp

Threat summary

Active exploitation appears in 95 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
146 mentions across 33 observed days

What's happening

Active exploitation reported across 95 signals
Exploit tool or code specified in 18 signals
PoC mentioned or linked in 15 signals
Patch or workaround mentioned in 51 signals
Technical details provided in 75 signals
Disclosure: 21 classified signals
Peaked 22d ago at 47 mentions (2026-06-30); latest day: 2
146 total mentions across 33 days

Affected systems

Vendors

simple-help

Products

simplehelp

1 version affected across 1 product

Deep dive

Activity timeline146 mentions / 33d

Signal classification6 categories

Active Exploitation

9061.6%

Disclosure

2114.4%

Patch

2013.7%

PoC

74.8%

General

53.4%

Exploit

32.1%

Referenced assets92 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-12	3	Disclosure1Patch2
2026-06-13	1	Patch1
2026-06-14	3	Active Exploitation1Disclosure2
2026-06-15	7	Active Exploitation1Disclosure2Patch2PoC2
2026-06-16	12	Active Exploitation1Disclosure8General2Patch1
2026-06-17	2	Exploit1Patch1
2026-06-18	1	Exploit1
2026-06-19	2	Patch2
2026-06-23	1	Patch1
2026-06-29	10	Active Exploitation9Patch1
2026-06-30	47	Active Exploitation43Disclosure2Patch1PoC1
2026-07-01	20	Active Exploitation15Exploit1Patch4
2026-07-02	4	Active Exploitation1Disclosure1General1PoC1
2026-07-03	2	Active Exploitation1General1
2026-07-04	3	Active Exploitation1Disclosure2
2026-07-05	3	Active Exploitation3
2026-07-06	2	Active Exploitation2
2026-07-07	4	Active Exploitation3Patch1
2026-07-08	1	Active Exploitation1
2026-07-09	1	Active Exploitation1
2026-07-12	1	PoC1
2026-07-13	1	General1
2026-07-18	2	Active Exploitation2
2026-07-20	2	PoC2
2026-07-21	1	Disclosure1
2026-07-28	1	Patch1
2026-08-31	1	Patch1
2026-09-02	1	Active Exploitation1
2026-09-05	1	Patch1
2026-09-06	1	Active Exploitation1
2026-09-10	1	Disclosure1
2026-09-11	2	Active Exploitation2
2026-09-18	2	Active Exploitation1Disclosure1

Full discourse20 posts

Horizon3 Attack Team@Horizon3Attack137d
Disclosure
Today we are disclosing CVE-2026-48558, an auth bypass in #SimpleHelp RMM when OIDC is configured. Affected servers let unauth attackers create a Technician session - allowing remote control, script exec, monitoring. High-level details and IOCs: https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/
Post summary
The post announces CVE‑2026‑48558 as an authentication bypass in SimpleHelp RMM, outlining its impact and providing IOCs, but offers no PoC, exploit code, patch, or evidence of ongoing exploitation.
115238125.0K
12.3K followersView on X
CISA Cyber@CISACyber120d
Patch
🛡️ We added SimpleHelp authentication bypass vulnerability CVE-2026-48558 to our Known Exploited Vulnerabilities Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/0CSxVRmkqu
Post summary
The tweet alerts to CVE‑2026‑48558, emphasizing the need for mitigations rather than providing exploit details, suggesting a patch or remedy focus.
112146412.1K
301.8K followersView on X
Jλckλι@J4ck3LSyN117d
PoC
CVE-2026-48558 PoC + Report [PoC]: https://github.com/J4ck3LSyN-Gen2/CVE-2026-48558 [Report]: https://github.com/J4ck3LSyN-Gen2/Reports/blob/main/OS-IS-CVE-2026-48558-07-2026.md [WriteUp]: https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/ [Malware Campaigns]: https://osintsights.com/hackers-exploit-simplehelp-flaw-to-deploy-djinn-stealer-malware?utm_source=mastodon&utm_medium=social Thank you @Horizon3ai for the report.. #CyberSecurity #InfoSec #CVE #AuthBypass https://t.co/oO462k3gxI
Post summary
The tweet provides a PoC and detailed report for CVE-2026-48558, links to a write‑up and malware campaign evidence, confirming the CVE is actively exploited in the wild.
17036162.2K
437 followersView on X
The Hacker News@TheHackersNews119d
Active Exploitation
🛑 SimpleHelp RMM CVE-2026-48558 exploited for OIDC authentication bypass. Attackers gain technician sessions to deploy TaskWeaver and Djinn Stealer. Djinn Stealer targets cloud, code, AI tools, browsers, SSH, and wallets. Read the full story: https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html
Post summary
CVE-2026-48558 was actively exploited to bypass OIDC authentication in SimpleHelp RMM, allowing attackers to gain technician sessions and deploy TaskWeaver and Djinn Stealer malware.
57040419.1K
2.3M followersView on X
Horizon3.ai@Horizon3ai134d
PoC
🚨 We discovered an authentication bypass in SimpleHelp that can give attackers their own Technician account. Rapid Response test now available for CVE-2026-48558. https://t.co/pgVaNHGCBZ
Post summary
An authentication bypass in SimpleHelp (CVE‑2026‑48558) was discovered, and a Rapid Response test (PoC) is available via the provided link.
1841401.4K
2.9K followersView on X
FOFA@fofabot134d
Disclosure
⚠️⚠️ CVE-2026-48558 (CVSS 10.0): OIDC auth-bypass in SimpleHelp remote support lets attackers forge identity tokens and seize admin control. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJTaW1wbGVIZWxwIg== 🎯106K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="SimpleHelp" Deep Dive: https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/ #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The tweet announces CVE‑2026‑48558, detailing an OIDC auth‑bypass vulnerability with a CVSS score of 10.0 and linking to a deep dive that likely contains a PoC, but no active exploitation or patch information is provided.
0402032.3K
14.6K followersView on X
dbugs@ptdbugs118d
Exploit
Publication of an exploit (PoC) for SimpleHelp (CVE-2026-48558) PT ID: PT-2026-48947 For informational purposes only. Type of vulnerability: Authentication Bypass Affected versions: SimpleHelp 5.5.15 and lower, 6.0 RC1 and lower (with OIDC authentication enabled) Privileges obtained: SYSTEM The author attaches a Python exploit for CVE-2026-48558 -> (https://dbugs.ptsecurity.com/vulnerability/PT-2026-48947) — a critical vulnerability in SimpleHelp, disclosed by http://Horizon3.ai -> (https://horizon3.ai/attack-research/vulnerabilities/cve-2026-48558/) on June 12, 2026, with a base CVSS score of 10. The vulnerability lies in incorrect validation of identity provider assertions in SimpleHelp's OIDC authentication: an unauthenticated attacker with access to the server's OIDC callback endpoint can create their own Technician account and log in on their behalf, bypassing MFA (because the technician configures it themselves on the first login). With this level of access, they can remotely connect to managed endpoints, run scripts as SYSTEM, and perform other administrative actions. SimpleHelp -> (https://simple-help.com/) is a commercial RMM (Remote Monitoring & Management) platform used by internal IT teams and MSP providers for remote support of end users. According to http://Horizon3.ai -> (https://www.bleepingcomputer.com/news/security/simplehelp-bug-lets-hackers-create-rogue-remote-support-accounts/), at the time of disclosure, approximately 14,000 SimpleHelp servers were accessible on the internet, of which about 7.2% used OIDC authentication — meaning the potentially vulnerable subset is around 1,000 instances. In most of the environments checked by http://Horizon3.ai -> (http://horizon3.ai/), the "Allow group authenticated logins" parameter, necessary for exploitation, was enabled. It's worth noting that the vulnerability was detected by an autonomous AI system http://Horizon3.ai -> (http://horizon3.ai/) called Sua Sponte. SimpleHelp has already been involved in the context of ransomware groups: initial vulnerabilities -> (https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/) in January 2025 formed the basis for a series of attacks by DragonForce and other operators, one of which was added to the CISA KEV catalog -> (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) in May 2025, and two more in April 2026. #dbugs_darkweb
Post summary
A Python PoC exploit for CVE-2026-48558 that bypasses OIDC authentication in SimpleHelp has been released, with evidence of active exploitation reported via CISA KEV and a CVSS score of 10; no patch or mitigation is mentioned.
0101561.9K
3.4K followersView on X
Rahmi Demir ⭐⭐⭐⭐⭐@rahmid3mir115d
Disclosure
🪲🪲🪲 Siber Güvenlik Zaafiyet Bülteni #SiberGüvenlik #GüvenlikBülteni Merhaba #Brolyz #Zafiyet: #SimpleHelp - Kimlik Doğrulama Atlatma (Authentication Bypass) CVE Kodu: CVE-2026-48558 Zafiyet Türü: Kriptografik İmzanın Yanlış/Eksik Doğrulanması (CWE-347) Fidye Yazılımı (Ransomware) Faaliyeti: Bilinmiyor 📌 Zafiyetin Özeti SimpleHelp yazılımının OIDC (OpenID Connect) kimlik doğrulama akışında kritik bir kimlik doğrulama atlatma zafiyeti tespit edilmiştir. OIDC kimlik doğrulaması yapılandırıldığında, giriş işlemi sırasında sunulan kimlik token'ları (identity tokens) kriptografik imzaları doğrulanmadan kabul edilmektedir. Bu yapılandırma zafiyeti, uzaktan ve kimliği doğrulanmamış bir saldırganın sahte bir token üreterek sisteme sunmasına ve tam yetkili bir "teknisyen" oturumu elde etmesine olanak tanır. Bazı yapılandırmalarda bu durum, çok faktörlü kimlik doğrulama (MFA) adımlarının da atlatılmasına neden olabilmektedir. 🛠️ Alınması Gereken Aksiyonlar 👉 Yama ve Güncelleme: Üretici tarafından yayınlanan güvenlik güncellemelerini ve hafifletici önlemleri (mitigations) ivedilikle test ve prod ortamlarınıza uygulayın. 👉 Risk ve Uyumluluk: CISA'nın BOD 26-04 (Risk Temelli Güvenlik Güncellemelerinin Önceliklendirilmesi) ve Adli Bilişim Triyaj Gereksinimleri yönergelerine uygun hareket edin. 👉 Erişim Kontrolü: İlgili varlıkların internete maruz kalma durumunu (internet exposure) değerlendirin ve yetkisiz erişimleri engellemek için gerekli sıkılaştırmaları yapın. 👉 İzolasyon: Eğer bulut servisleri veya on-prem sistemler için geçerli bir yama veya hafifletici önlem henüz bulunmuyorsa, zafiyet giderilene kadar ürünün kullanımını durdurun veya dış ağ erişimini tamamen kısıtlayın.
Post summary
The bulletin discloses CVE‑2026‑48558—a crypto signature verification flaw in SimpleHelp’s OIDC flow that permits unauthenticated token forging and MFA bypass—and urges immediate patching and mitigation steps.
060150201
529 followersView on X
Daily CyberSecurity@the_yellow_fall120d
Active Exploitation
CVE-2026-48558, a SimpleHelp authentication bypass, is exploited in the wild to deploy TaskWeaver and Djinn Stealer. CISA added it to KEV. Patch now. #SimpleHelp #CVE202648558 #InfoStealer #RMMSecurity #ExploitedInTheWild #CyberSecurity https://securityonline.info/simplehelp-authentication-bypass-exploited https://t.co/xNK5SXtFyd
Post summary
CVE‑2026‑48558, an authentication bypass in SimpleHelp, is actively exploited to deploy TaskWeaver and Djinn Stealer, has been added to CISA KEV, and a patch is now available.
0301421.6K
12.9K followersView on X
The Shadowserver Foundation@Shadowserver117d
General
We are scanning for SimpleHelp CVE-2026-48558 vulnerable instances since 2026-06-16. We see 439 unpatched in our 2026-07-01 scan. Most (268) found in the US. Raw IP data in https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-http-report/ for your network/constitiuency Dashboard World Map view: https://dashboard.shadowserver.org/statistics/combined/map/?date_range=1&map_type=std&source=http_vulnerable&source=http_vulnerable6&tag=cve-2026-48558%2B&data_set=count&scale=log&auto_update=on https://t.co/BdzKTT89dQ
Post summary
The announcement reports 439 unpatched SimpleHelp instances for CVE‑2026‑48558, provides raw IP data and a dashboard link, but offers no technical details, exploits, or patch information.
1301133.2K
22.0K followersView on X
Dark Web Intelligence@DailyDarkWeb132d
Exploit
🌐 Multiple Countries - SimpleHelp Vulnerability Exploit Allegedly Offered for Sale A threat actor is advertising the sale of an alleged exploit targeting SimpleHelp, referencing CVE-2026-48558. According to the forum post: * Alleged target: SimpleHelp * Referenced vulnerability: CVE-2026-48558 * Claimed implementation: Python * Claimed privilege level: SYSTEM * Advertised price: $2,500 * Escrow accepted The seller claims the exploit can provide elevated privileges on vulnerable systems, potentially leading to full system compromise if the vulnerability is legitimate and remains unpatched. Potential risks include: * Remote system compromise * Privilege escalation to SYSTEM level * Ransomware deployment * Data theft and exfiltration * Lateral movement within enterprise environments * Supply chain attacks against managed service providers (MSPs) * Unauthorized access to remote support infrastructure SimpleHelp is widely used as a remote support and remote access platform, making vulnerabilities affecting the product particularly attractive to threat actors seeking access to managed environments. At the time of reporting, the exploit's authenticity, reliability, and effectiveness have not been independently verified. It is also unclear whether the seller possesses a working exploit or is attempting to resell publicly available information. Analyst Note: Sales posts involving recently disclosed CVEs should be treated as an early warning indicator rather than proof of active exploitation. Organizations using SimpleHelp should review vendor advisories, verify patch status, and monitor for emerging exploitation activity associated with CVE-2026-48558. #DDW #Intelligence #DarkWeb #SimpleHelp
Post summary
The forum post advertises a sale of an alleged SimpleHelp exploit for CVE‑2026‑48558, but no evidence of a working exploit or active attacks exists.
0201423.4K
198.1K followersView on X
YogSotho@YogSoth0115d
Disclosure
#CVE-2026-48558 SimpleHelp RMM OIDC #Exploit kit | | **Product** | SimpleHelp Remote Monitoring & Management (RMM) | | **Auth required** | None (pre-authentication) | | **Impact** | Full technician/admin session → remote control of every managed endpoint | | **Affected** | SimpleHelp ≤ 5.5.15 and 6.0 pre-release | #0days #hacking #cybersecurity #cybernews #simplehelp #security #
Post summary
The post announces CVE‑2026‑48558 as affecting SimpleHelp RMM with pre‑auth via OIDC, offering remote control, but provides no PoC, exploit, or patch details.
100106692
1.9K followersView on X
Rahmi Demir ⭐⭐⭐⭐⭐@rahmid3mir119d
Active Exploitation
🚨 #GüvenlikBülteni #SiberGüvenlik: SimpleHelp'te Kritik Kimlik Doğrulama Açığı Aktif Olarak İstismar Ediliyor (CVE-2026-48558) Merhaba #Brolyz SimpleHelp'te bulunan CVE-2026-48558 (CVSS 10.0) numaralı kritik kimlik doğrulama atlatma zafiyeti, saldırganlar tarafından TaskWeaver ve Djinn Stealer zararlı yazılımlarını dağıtmak için aktif olarak kullanılıyor.Açık,ABD CISA tarafından KEV kataloğuna eklendi 📌 Özet OIDC kimlik doğrulama mekanizmasındaki hata sayesinde kimliği doğrulanmamış bir saldırgan,sahte belirteç oluşturarak tam yetkili teknisyen oturumu elde edip yönetilen sistemlere uzaktan erişim sağlayabiliyor 🔍 Teknik Detaylar • CVE-2026-48558, OIDC kimlik doğrulamasını etkileyen kritik bir Authentication Bypass zafiyetidir • MFA etkin olsa bile saldırganlar ilk girişte kendi MFA yöntemlerini tanımlayarak korumayı aşabiliyor • İlk aşamada TaskWeaver adlı Node.js tabanlı yükleyici çalıştırılıyor • Ardından Djinn Stealer;Windows,Linux ve macOS sistemlerinden hassas verileri çalıyor ⚠️ Hedeflenen Veriler • Tarayıcı parolaları ve oturum bilgileri • AWS, Azure, Google Cloud ve diğer bulut kimlik bilgileri • GitHub, SSH anahtarları ve Docker kimlik doğrulama verileri • AI araçları yapılandırmaları • Kripto para cüzdanları ve anahtar depoları 🛡️ Alınması Gereken Aksiyonlar 1️⃣ SimpleHelp'i en güncel sürüme yükseltin 2️⃣ OIDC yapılandırmalarını ve yetkisiz Teknisyen hesaplarını kontrol edin 3️⃣ RMM sunucularında olağandışı oturum, dosya transferi ve script çalıştırmalarını izleyin 4️⃣ Yönetici hesapları ile bulut erişim anahtarlarını gerekirse döndürün 5️⃣ IOC taramasıyla olası veri sızıntısı ve kalıcılık mekanizmalarını araştırın 📊 Neden Önemli? Tek bir kimlik doğrulama açığı; RMM altyapısı üzerinden bulut ortamlarına, kaynak kod depolarına, yapay zekâ araçlarına ve kripto cüzdanlarına kadar uzanan geniş çaplı ihlallere yol açabiliyor. Bu nedenle yalnızca yamalama değil, Threat Hunting ve Incident Response süreçleri de kritik önem taşıyor.
Post summary
Attackers are actively exploiting CVE‑2026‑48558 with TaskWeaver and Djinn Stealer, enabling full technician-level access; the post details the attack chain and urges immediate patching and monitoring.
02060100
529 followersView on X
CloudSecurityAlliance@cloudsa119d
Active Exploitation
CISO Daily Briefing: SimpleHelp CVE-2026-48558 (CVSS 10.0) actively exploited — CISA KEV deadline July 2, Djinn Stealer harvesting AI dev credentials; Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8): ShinyHunters confirmed 100+ orgs breached, including Nissan; AI browser agents silently exfiltrate enterprise SSO tokens via injected page content — 6 products affected, Anthropic patch did not hold; NIST formally proves finite guardrail sets bypassable. https://labs.cloudsecurityalliance.org/research/ciso-daily-briefing-20260630/
Post summary
SimpleHelp’s CVE‑2026‑48558, with a CVSS score of 10.0, is actively exploited as noted in the CISA KEV alert, while Oracle PeopleSoft CVE‑2026‑35273 has also caused widespread breaches; patches such as Anthropic’s proved ineffective.
121301.1K
18.9K followersView on X
Horizon3.ai@Horizon3ai120d
Active Exploitation
CVE-2026-48558 has been added to the @CISAgov KEV: https://www.cisa.gov/news-events/alerts/2026/06/29/cisa-adds-one-known-exploited-vulnerability-catalog Details below 👇
Post summary
CVE‑2026‑48558 has been listed in CISA’s Known Exploited Vulnerability Catalog, indicating it is actively being exploited in the wild.
00061722
3.0K followersView on X
Jλckλι@J4ck3LSyN108d
PoC
[CVE-2026-39047]: https://github.com/J4ck3LSyN-Gen2/CVE-2026-13768 [CVE-2026-48558]: https://github.com/J4ck3LSyN-Gen2/CVE-2026-48558 [CVE-2026-13768]:https://github.com/J4ck3LSyN-Gen2/CVE-2026-13768
Post summary
The post lists GitHub repositories for three CVEs, suggesting the availability of proof‑of‑concept or exploit code, but provides no evidence of active exploitation, patches, or detailed technical information.
02031805
438 followersView on X
piyokango@piyokango119d
Active Exploitation
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（6/29追加） 🛡CVE-2026-48558 ✅概要・深刻度：緊急 9.5 (CVSS Base) / VulnCheck (CNA) ・種別：デジタル署名の不適切な検証 (CWE-347) ・CVSS:CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H SimpleHelp 5.5.15 以前および 6.0 pre-release に存在する、OIDC 認証フローの認証バイパス脆弱性です。 OIDC 認証が設定されている場合、ログイン時に送信された identity token の暗号署名が検証されず、未認証のリモート攻撃者が偽造トークンにより technician session を取得できる可能性があります。構成によっては、多要素認証を回避される可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：中 ✅CISA 評価・攻撃自動化：自動化は可能・技術的影響：完全制御 ✅攻撃前提条件・SimpleHelp 5.5.15 以前、または 6.0 pre-release を使用している・SimpleHelp で OIDC 認証プロバイダが設定されている・TechnicianGroup に OIDC provider が関連付けられている・TechnicianGroup で “Allow group authenticated logins” が有効である・攻撃者が対象 SimpleHelp サーバーへネットワーク経由でアクセスできる・SimpleHelp 5.5.16 以降、または修正済みリリースへ更新されていない ✅悪用時影響・未認証の攻撃者に technician session を取得される可能性がある・多要素認証を回避される可能性がある・Technician 権限で管理対象端末へのリモート接続やスクリプト実行を行われる可能性がある・RMM 機能を悪用してファイル転送やマルウェア実行を行われる可能性がある・管理対象端末や下流顧客環境に被害が拡大する可能性がある ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（Blackpoint Cyber / Horizon3 .ai） Horizon3 .ai は、CVE-2026-48558 を発見し、OIDC が有効な SimpleHelp 環境で未認証攻撃者が新規 Technician ユーザーとして認証できることを実環境条件で検証したと公表。Blackpoint Cyber は、CVE-2026-48558 の悪用により攻撃者が SimpleHelp の technician session を取得し、RMM 機能を用いて TaskWeaver と Djinn Stealer を展開した侵害を確認したと公表。 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-48558 ・https://simple-help.com/security/simplehelp-security-update-2026-05 ・https://simple-help.com/release-news ・https://github.com/cisagov/vulnrichment/blob/develop/2026/48xxx/CVE-2026-48558.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558 ・https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/ ・https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/ #vulnerability
Post summary
The article confirms that CVE‑2026‑48558 is being actively exploited, with evidence from Blackpoint Cyber and Horizon3; a PoC has been partially published and a patch is available.
010505.4K
44.1K followersView on X
Nicolas Krassas@Dinosn119d
Active Exploitation
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html
Post summary
Attackers are actively exploiting CVE-2026-48558 in SimpleHelp to deploy TaskWeaver and Djinn Stealer.
000411.8K
160.8K followersView on X
pdnuclei-bot@pdnuclei_bot47d
Disclosure
🚨 CVE-2026-48558 - critical 🚨 SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass > SimpleHelp <= 5.5.15 and 6.0 pre-release contain an authentication bypass caused by l... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-48558 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE‑2026‑48558, a critical OIDC JWT authentication bypass in SimpleHelp <=5.5.15 and 6.0 pre‑release, and links to a library page for more information.
01021323
1.3K followersView on X
Julio Bandeira de Melo@juliobmelo114d
Active Exploitation
CISA recently added CVE-2026-48558 to the KEV catalog. CVSS 10.0 auth bypass in SimpleHelp RMM, actively exploited to deploy Djinn Stealer. The stealer specifically targets AI dev credentials: Claude, Codex, CI/CD tokens, cloud keys. Patch immediately; rotate everything. https://www.cisa.gov/known-exploited-vulnerabilities-catalog @CISACyber , @BlackpointCyber , @Horizon3ai
Post summary
CISA flagged CVE‑2026‑48558 as a KEV with a CVSS 10.0 authentication bypass in SimpleHelp RMM, noting active exploitation via Djinn Stealer targeting AI development credentials, and urged immediate patching and credential rotation.
110201.1K
48.8K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	simple-help	simplehelp	-	-	-
App	simple-help	simplehelp	6.0	-	-

Explore more

Back to dashboard simple-help CVEs simplehelp vulnerabilities

What researchers are saying

CVE-2026-48558

Horizon3 Attack Team[verified]@Horizon3AttackDisclosure

The post announces CVE‑2026‑48558 as an authentication bypass in SimpleHelp RMM, outlining its impact and providing IOCs, but offers no PoC, exploit code, patch, or evidence of ongoing exploitation.

Horizon3.ai[verified]@Horizon3aiPoC

An authentication bypass in SimpleHelp (CVE‑2026‑48558) was discovered, and a Rapid Response test (PoC) is available via the provided link.

FOFA[verified]@fofabotDisclosure

The tweet announces CVE‑2026‑48558, detailing an OIDC auth‑bypass vulnerability with a CVSS score of 10.0 and linking to a deep dive that likely contains a PoC, but no active exploitation or patch information is provided.

dbugs[verified]@ptdbugsExploit

A Python PoC exploit for CVE-2026-48558 that bypasses OIDC authentication in SimpleHelp has been released, with evidence of active exploitation reported via CISA KEV and a CVSS score of 10; no patch or mitigation is mentioned.

Rahmi Demir ⭐⭐⭐⭐⭐[verified]@rahmid3mirDisclosure

The bulletin discloses CVE‑2026‑48558—a crypto signature verification flaw in SimpleHelp’s OIDC flow that permits unauthenticated token forging and MFA bypass—and urges immediate patching and mitigation steps.

Dark Web Intelligence[verified]@DailyDarkWebExploit

The forum post advertises a sale of an alleged SimpleHelp exploit for CVE‑2026‑48558, but no evidence of a working exploit or active attacks exists.

YogSotho[verified]@YogSoth0Disclosure

The post announces CVE‑2026‑48558 as affecting SimpleHelp RMM with pre‑auth via OIDC, offering remote control, but provides no PoC, exploit, or patch details.

Rahmi Demir ⭐⭐⭐⭐⭐[verified]@rahmid3mirActive Exploitation

Attackers are actively exploiting CVE‑2026‑48558 with TaskWeaver and Djinn Stealer, enabling full technician-level access; the post details the attack chain and urges immediate patching and monitoring.