Loading story…
Attackers are actively exploiting CVE-2026-48558, a maximum-severity authentication bypass in SimpleHelp RMM, to forge OpenID Connect identity tokens and obtain fully authenticated technician sessions on exposed servers. The flaw affects deployments using generic OIDC or Azure AD OIDC because SimpleHelp accepted identity tokens without validating their cryptographic signatures, enabling unauthenticated access and, in some cases, bypass of MFA during technician enrollment. The issue affects SimpleHelp 5.5.1 through 5.5.15 and 6.0 pre-release builds before 6.0 RC2, and has been patched in 5.5.16+ and 6.0 RC2+.
In observed intrusions, attackers abused the trusted RMM channel to transfer files and execute commands across managed endpoints, deploying the obfuscated TaskWeaver Node.js loader followed by the newly identified Djinn Stealer malware. Reporting says TaskWeaver fetched additional payloads and used encrypted communications, while Djinn Stealer harvested credentials and sensitive data from browsers, cloud platforms, developer and package registry tooling, SSH environments, AI tools, and cryptocurrency wallets across Windows, macOS, and Linux before exfiltration. CISA added the flaw to its Known Exploited Vulnerabilities catalog, and sector alerts warned that compromise of a SimpleHelp server could give attackers downstream access across MSP and utility environments, increasing the risk of lateral movement, credential theft, and ransomware deployment.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
In the KEV entry, CISA ordered federal civilian executive branch agencies to remediate CVE-2026-48558 by the stated due date.
By emulating the TaskWeaver loader, Blackpoint retrieved the follow-on Djinn Stealer malware and documented its cross-platform credential and data theft behavior along with its exfiltration methods.
SimpleHelp made fixes available for the vulnerability in version 5.5.16 and in 6.0 RC2 or later, addressing the OIDC authentication bypass affecting earlier releases.
Blackpoint Cyber reported active exploitation of CVE-2026-48558 on internet-facing SimpleHelp servers, where attackers gained technician sessions and used the trusted RMM channel to push the TaskWeaver loader and Djinn Stealer to managed systems.
CISA added the SimpleHelp authentication bypass vulnerability to its Known Exploited Vulnerabilities catalog, formally recognizing active exploitation and directing agencies to apply mitigations under BOD 26-04.
Horizon3.ai publicly disclosed CVE-2026-48558, an authentication bypass flaw in SimpleHelp's OIDC flow that allows forged identity tokens to be accepted without signature verification.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
waterisac.org
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcesocradar.io
Open sourcehelpnetsecurity.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-48558**, a critical OIDC authentication bypass in the SimpleHelp remote monitoring and management platform, to gain technician-level access to internet-facing servers without valid credentials. Investigators found the intrusions used the trusted RMM channel to deploy **TaskWeaver**, a heavily obfuscated JavaScript/Node.js loader that established encrypted communications with attacker infrastructure and fetched a second-stage payload known as **Djinn Stealer**. Blackpoint Cyber said its disclosure of active exploitation prompted CISA to add the flaw to the **Known Exploited Vulnerabilities** catalog. Once deployed, Djinn Stealer harvested high-value secrets from Windows, macOS, and Linux systems, including cloud credentials, SSH keys, API keys, service account credentials, browser data, source-control and package-registry tokens, cryptocurrency wallets, and credentials tied to AI development tools. Researchers said the malware encrypted stolen data with **AES-256-GCM** and protected the encryption key with **RSA-2048** before exfiltration, while the campaign appeared to rely on opportunistic scanning for exposed vulnerable SimpleHelp instances rather than tightly targeted victim selection. The activity raises particular concern for MSPs and enterprises because a compromise of trusted RMM infrastructure can extend quickly into cloud, CI/CD, and software supply chain environments.
Aug 11, 2026
Researchers disclosed **CVE-2026-48558**, a maximum-severity authentication bypass in SimpleHelp remote management software that allows unauthenticated attackers to forge OpenID Connect identity tokens and log in as a technician. The flaw affects SimpleHelp `5.5.15` and earlier, along with `6.0` pre-release versions, because the OIDC login flow accepts submitted JWT identity tokens without verifying their cryptographic signature. The issue is rated `CVSS 10.0` and mapped to `CWE-347`, with no user interaction required for exploitation. Successful exploitation can give attackers an authenticated technician session with administrative reach into managed environments, including remote access to endpoints, script execution, and in some cases **MFA bypass** because technician accounts can enroll their own MFA method at first login. Horizon3.ai said the bug affects deployments using generic OIDC and Azure Active Directory OIDC, and estimated that internet-exposed SimpleHelp servers have grown to nearly **14,000**, with about **7.2%** using the vulnerable configuration. Defenders were urged to apply vendor patches immediately, restrict technician authentication by IP where patching is delayed, and review technician accounts and server logs for signs of compromise.
Jul 2, 2026
SimpleHelp released fixes for three **critical** vulnerabilities in its remote support and RMM software that can be chained to gain full control of vulnerable servers. The flaws are tracked as `CVE-2024-57726`, an authorization weakness that allows privilege escalation to administrator; `CVE-2024-57727`, an unauthenticated arbitrary file download issue that can expose sensitive data and credentials; and `CVE-2024-57728`, an authenticated administrator file upload flaw that can lead to remote code execution. Horizon3.ai disclosed the issues, and affected versions include SimpleHelp `5.5` before `5.5.8`, `5.4` before `5.4.10`, and `5.3` before `5.3.9`. CSIRT.SK reported that attackers have already targeted exposed SimpleHelp RMM systems, with Arctic Wolf observing intrusions in which threat actors used leaked credentials or exploited the vulnerabilities for initial access and compromise. The vendor urged organizations to patch immediately, rotate administrator and technician passwords, and restrict those account logins to trusted IP addresses to reduce the risk of server takeover and downstream compromise of managed endpoints.
Jul 24, 2026