CVE-2026-48558

Successful exploitation compromises technician authentication and exposes the remote-administration capabilities available to the resulting session. Attackers can access managed endpoints, transfer files, execute scripts and commands, install malware, and view, modify, or delete data, subject to the session's permissions. Compromise can extend across managed customer environments and facilitate lateral movement and credential theft. Observed exploitation deployed TaskWeaver and Djinn Stealer to collect sensitive credentials and configuration data, potentially enabling further access to cloud services, repositories, and other connected systems.

Until patched, disable the vulnerable OIDC authentication flow and use an unaffected authentication method where possible. Restrict technician login sources with IP allowlists and remove unnecessary internet exposure. Apply least-privilege technician permissions and network segmentation to limit access to managed systems. Monitor authentication events, new technician accounts, MFA enrollment, remote-command execution, and file transfers. MFA alone is not a reliable compensating control because some affected configurations allow its bypass.

Upgrade to SimpleHelp 5.5.16 or later, or 6.0 RC2 or a later fixed release. Apply corresponding updates supplied by downstream vendors where applicable. Because exploitation is confirmed, also review authentication logs, technician accounts, MFA registrations, and active sessions for unauthorized activity; terminate unknown sessions and investigate managed endpoints for malware deployment. Rotate potentially exposed credentials and revoke compromised tokens if unauthorized access or endpoint infection is identified.