SimpleHelp CVE-2026-48558: When Your MSP Becomes the Way In

Most SMBs hand the administration of their estate to a managed service provider, which deploys a remote monitoring and management tool, an RMM, on every host. This tool has, by design, privileged access to the entire estate. That is a considerable efficiency gain, and an equally considerable single point of failure. Vulnerability CVE-2026-48558 in SimpleHelp RMM is the perfect illustration: a flaw in your MSP's tool becomes a flaw in you.

Rated CVSS 10.0, this vulnerability was discovered by Zach Hanley of Horizon3.ai, disclosed on June 12, 2026, and added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of July 2, 2026. It is confirmed under active exploitation to deploy two previously unknown malware families, TaskWeaver and Djinn Stealer.

The mechanism: an identity token that is not verified

The flaw comes down to faulty validation of OpenID Connect token signatures. When OIDC is configured with group-authenticated login settings, an unauthenticated attacker can forge identity tokens to bypass multi-factor authentication and gain privileged technician-level access to vulnerable SimpleHelp servers, without valid credentials. Concretely, versions 5.5.15 and earlier, as well as 6.0 prereleases, accept an identity token during OIDC login without verifying its cryptographic signature.

This is an authentication bypass, T1190 (Exploit Public-Facing Application), that results in the use of a system-valid account, T1078 (Valid Accounts). The attacker gains technician access, meaning the ability to push commands and software to every host managed by the server. That is exactly the level of access a ransomware operator dreams of.

The scale of the problem

This flaw is all the more concerning because SimpleHelp is widely deployed, often exposed directly on the internet to allow technicians remote access. The number of exposed servers runs into the thousands, a significant share of which remain vulnerable. For an SMB, the question is whether its provider's SimpleHelp server is up to date, a question that spills beyond the client's usual technical perimeter but concerns it directly.

A Nuclei detection to check the version

A Nuclei template lets you identify a reachable SimpleHelp server and read its version, to compare it against the fixed threshold, namely version 5.5.16. This check is useful both to the provider, to audit its own fleet, and to a client keen to verify the exposure that affects it.

id: simplehelp-version-check
info:
  name: SimpleHelp RMM exposed version
  author: threatclaw
  severity: info
  description: Reads the version of an exposed SimpleHelp server to compare it against the fixed 5.5.16 threshold
  reference:
    - https://arcticwolf.com/resources/blog/cve-2026-48558-critical-authentication-bypass-vulnerability-in-simplehelp-rmm-exploited-for-credential-theft-and-malware-delivery/
  tags: simplehelp,rmm,cve-2026-48558,kev
http:
  - method: GET
    path:
      - "{{BaseURL}}/allservices"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "SimpleHelp"
      - type: status
        status:
          - 200
    extractors:
      - type: regex
        part: body
        regex:
          - '5\.5\.[0-9]+'
          - '6\.0'

The template extracts the displayed version. It is up to you to cross-check the result against the threshold: any version earlier than 5.5.16, or a 6.0 prerelease, must be considered vulnerable and patched without delay.

Watch for technician account creation

Beyond patching, you must verify that no access was taken before it. The most telling signal of successful exploitation is the appearance of new, unplanned technician accounts on the SimpleHelp server. A Sigma rule on the server's application logs, watching for administrator or technician account creation, catches this takeover. Also look, on managed hosts, for the execution of unexpected payloads pushed via the SimpleHelp agent, a sign that technician access was used to distribute the TaskWeaver and Djinn Stealer families.

What an SMB can ask its provider

The practical consequence of this flaw is that a client has the right, and the interest, to question its MSP on three concrete points. Is the SimpleHelp server at version 5.5.16 or higher. Was OIDC enabled with group authentication, the vulnerable configuration, and if so, was an access review conducted. Finally, is the server interface exposed directly on the internet, or restricted to a trusted network. These questions are basic supply-chain hygiene, now an integral part of an SMB's security.

Verifying exposure and prioritizing patches on an actively exploited vulnerability requires up-to-date scan templates, aligned with the KEV. That is what the ThreatClaw Nuclei feed provides: templates refreshed at the pace of disclosures, so you know within minutes whether a tool in your supply chain is exposing you.