{"id":"simplehelp-rmm-flaws-exploited-apr-2026","category":"patch","status":"closed","title":"SimpleHelp remote support software: CVE-2024-57726 and CVE-2024-57728 used in attacks, fixed since 2025","tldr":"CISA listed two SimpleHelp remote-support flaws (CVE-2024-57726, CVE-2024-57728) as exploited on 24 April 2026. Fixed in v5.5.8 and later. If you or your IT provider run SimpleHelp, update, change admin and technician passwords, and replace API keys.","summary":"SimpleHelp is remote support and monitoring software that IT providers run on a server to control customers' computers. Two flaws in versions 5.5.7 and earlier were added to CISA's list of flaws used in attacks on 24 April 2026. CVE-2024-57726 lets a low-privileged technician account create API keys that escalate to server administrator. CVE-2024-57728 lets an administrator upload a crafted zip file to write files anywhere on the server and run code as the SimpleHelp server user. SimpleHelp fixed the problems in 2025: version 5.5.8 or later, or patches for 5.4.10 and 5.3.9. Its notice also advises changing administrator and technician passwords and API tokens, and restricting logins by IP address. Reporting from 2025 describes ransomware actors, including DragonForce as seen by Sophos, using these flaws together with CVE-2024-57727 to reach customers of IT providers. The 2026 listing does not say a new fix was issued. Businesses and managed IT providers are most exposed; a family is affected only if its IT support uses SimpleHelp.","action":"If you run SimpleHelp, upgrade to version 5.5.8 or later (or apply the vendor patch for 5.4.10 or 5.3.9), then change administrator and technician passwords and create new API keys. If a managed IT provider looks after your devices, ask whether they use SimpleHelp and have done this.","product":"SimpleHelp remote support and monitoring server","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2024-57726","CVE-2024-57728"],"tags":["simplehelp","rmm","remote-access","ransomware","cisa-kev","dragonforce","privilege-escalation","path-traversal"],"affected":["SimpleHelp 5.5.7 and earlier"],"fixed":["SimpleHelp 5.5.8 or later","Patch for SimpleHelp 5.4.10","Patch for SimpleHelp 5.3.9"],"matches":[],"sources":[{"kind":"advisory","title":"Security vulnerabilities in SimpleHelp 5.5.7 and earlier","url":"https://guides.simple-help.com/kb---security-vulnerabilities-01-2025","by":"SimpleHelp","date":"2025-02-12"},{"kind":"news","title":"Ransomware Gang Exploits SimpleHelp RMM to Compromise Utility Billing Firm","url":"https://www.infosecurity-magazine.com/news/ransomware-simplehelp-compromise","by":"Infosecurity Magazine","date":"2025-06-13"},{"kind":"research","title":"CISA adds four known exploited vulnerabilities to catalog (2026-04-24)","url":"https://aviatrix.ai/threat-research-center/cisa-adds-four-known-exploited-vulnerabilities-to-catalog-2026-04-24","by":"Aviatrix","date":"2026-04-24"}],"started":"2026-04-24","closed":"2026-04-24","created":"2026-11-03T21:47:07.572Z","updated":"2026-11-03T21:47:07.572Z","cve_notes":[{"cve":"CVE-2024-57726","name":"Missing authorization in SimpleHelp API key creation","what":"A missing permission check in SimpleHelp lets a low-privileged technician create API keys with excessive permissions, which can be used to become the server administrator.","severity":"critical","cvss":9.9},{"cve":"CVE-2024-57728","name":"Zip-slip path traversal in SimpleHelp file upload","what":"A path traversal flaw in SimpleHelp that lets an administrator upload a crafted zip file to write files anywhere on the server, leading to code running as the SimpleHelp server user.","severity":"high","cvss":7.2}],"timeline":[{"at":"2026-04-24","added":"2026-11-03T21:46:16.197Z","kind":"cisa-added","text":"CISA added CVE-2024-57726 and CVE-2024-57728 to its catalogue of flaws used in attacks. A secondary summary lists both as exploited in the wild and affecting SimpleHelp 5.5.7 and earlier.","url":"https://aviatrix.ai/threat-research-center/cisa-adds-four-known-exploited-vulnerabilities-to-catalog-2026-04-24","by":"Aviatrix","patch":null},{"at":"2025-06-13","added":"2026-11-03T21:46:16.197Z","kind":"wider-attacks","text":"Reporting on a CISA advisory said ransomware actors had breached customers of a utility billing software provider through unpatched SimpleHelp. Sophos had seen DragonForce ransomware deployed in May 2025 using CVE-2024-57726, CVE-2024-57727 and CVE-2024-57728.","url":"https://www.infosecurity-magazine.com/news/ransomware-simplehelp-compromise","by":"Infosecurity Magazine","patch":null},{"at":"2025-02-12","added":"2026-11-03T21:46:16.197Z","kind":"other","text":"SimpleHelp's notice was updated to list the CVE identifiers, including CVE-2024-57726 and CVE-2024-57728. It advises upgrading to v5.5.8 or later, or applying the patch for v5.4.10 or v5.3.9, and changing administrator and technician passwords and API tokens.","url":"https://guides.simple-help.com/kb---security-vulnerabilities-01-2025","by":"SimpleHelp","patch":null},{"at":"2025-01-12","added":"2026-11-03T21:46:16.197Z","kind":"disclosed","text":"SimpleHelp published its security notice for versions 5.5.7 and earlier, starting with a patch for v5.3.9. Fixes followed in v5.5.8 and patches for v5.4.10 (reissued 31 January 2025).","url":"https://guides.simple-help.com/kb---security-vulnerabilities-01-2025","by":"SimpleHelp","patch":"patched"}],"url":"https://hard.fyi/live/simplehelp-rmm-flaws-exploited-apr-2026/","json":"https://hard.fyi/api/live?id=simplehelp-rmm-flaws-exploited-apr-2026"}