CVE-2026-48558 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-06-12

Added to CISA KEV: 2026-06-29 17 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: This vulnerability is in CISA KEV and actively exploited. Immediately review logs for forged/anomalous OIDC token logins, unexpected technician sessions, and IOCs associated with TaskWeaver and Djinn Stealer. Verify integrity of the SimpleHelp server and all managed endpoints for signs of lateral compromise.
Upgrade immediately to SimpleHelp 5.5.16 or later (or 6.0 RC2+) per the vendor advisory (simple-help.com/security/simplehelp-security-update-2026-05).
If patching cannot be done immediately, disable OIDC authentication as the primary workaround, and restrict server access via IP allowlisting/VPN.
Rotate all technician credentials, session tokens, and any secrets accessible from the RMM server; re-enroll/re-verify managed endpoints if compromise is suspected.
Monitor for outbound connections to attacker infrastructure and for deployment of stealer/backdoor payloads across managed hosts.
Patch priority: EMERGENCY / P0 — patch within 24-48 hours for internet-facing instances.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-48558 is a critical authentication bypass vulnerability affecting SimpleHelp remote monitoring and management (RMM) software, specifically versions 5.5.15 and prior as well as 6.0 pre-release versions. The flaw exists within the application's OpenID Connect (OIDC) authentication flow, where the system fails to verify the cryptographic signatures of identity tokens submitted during login. This oversight allows unauthenticated attackers to supply crafted JSON Web Tokens (JWTs) to hijack technician sessions, making it a significant threat to organizations relying on SimpleHelp for remote access and management ^[1]^[2].

Exploitation

Active Exploitation: The vulnerability is under active exploitation in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog ^[5].
Threat Actors/Campaigns: Attackers have utilized this flaw to deploy malicious payloads, including "TaskWeaver" and "Djinn Stealer," which target credentials across various cloud, AI, and cryptocurrency wallet platforms ^[4]^[6].
PoC/Exploit Tools: Proof-of-concept material and research regarding this authentication bypass are publicly available ^[7].
Prerequisites: The attack is network-based and does not require local access or valid authentication; it relies on the target server having OIDC authentication enabled ^[1]^[2].

Affected Products & Patches

Affected Versions: SimpleHelp versions 5.5.15 and all earlier versions, as well as 6.0 pre-release versions ^[1].
Patches: Organizations should upgrade to a secure, non-vulnerable version released by the vendor.
Mitigations: If patching is not immediately feasible, disabling the OIDC authentication feature until a patch is applied is the primary recommended workaround to prevent exploitation.

Impact

Access/Capability: Successful exploitation grants an unauthenticated attacker full administrative access to the affected SimpleHelp server, effectively allowing them to hijack existing technician sessions and control connected endpoints ^[2]^[3].
Business Risk: For internet-facing deployments, this vulnerability presents an extreme risk, as thousands of servers have been identified as exposed. Compromise allows attackers to move laterally into the managed environment, harvest credentials, and deploy malware across the entire infrastructure managed by the RMM tool ^[3]^[4].

Sources

NVD-CVE-2026-48558
CVE-2026-48558 Detail Description SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryp…
CVE-2026-48558 - Vulnerability Details - OpenCVE
The vulnerability is listed in the CISA KEV catalog. An attacker can send a crafted JWT to the OIDC authentication endpoint, taking advantage of the missing signature validation to hijack a technician session. Generated by OpenCVE AI on September 2, 2026 at 14:47 UTC.
CVE-2026-48558 Exposes 14,000 SimpleHelp RMM Servers to Auth Bypass
CVE-2026-48558, a critical OIDC authentication bypass in SimpleHelp RMM, lets unauthenticated attackers gain full admin access on 14,000 exposed servers.
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and ...
Attackers exploited SimpleHelp CVE-2026-48558 to deliver TaskWeaver and Djinn Stealer, targeting credentials across cloud, code, AI, and wallet tools.
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-48558…

🔴 CVE-2026-48558