NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

SimpleHelp sign-in bypass CVE-2026-48558 exploited to spread credential-stealing malware; fixes available

Attackers used a SimpleHelp sign-in flaw to reach computers managed by IT support providers and install credential-stealing malware. Ask your provider to update its server to 5.5.16 or 6.0 RC2 or later and check for unauthorised access.

What to do

If an IT support provider uses SimpleHelp to manage your family’s or business’s computers, ask them to update the server to 5.5.16 or 6.0 RC2 or later and check technician accounts and logs for unauthorised access. If compromise is found, have them investigate managed computers, end unauthorised sessions and replace exposed credentials.

What’s happening

CVE-2026-48558 lets attackers gain technician access to vulnerable SimpleHelp remote support servers without a valid password. It affects certain OpenID Connect (OIDC) single sign-on configurations: an identity provider must be configured, linked to a technician group, and that group must allow group-authenticated logins. Attackers can then access managed computers and run software. SimpleHelp dates its fixes, 5.5.16 and 6.0 RC2, to 26 May; BleepingComputer reported 9 June, which SimpleHelp identifies as the date researchers confirmed patch availability. On 29 June, Blackpoint Cyber reported a contained intrusion involving TaskWeaver and Djinn Stealer, which targets credentials, browser data and cryptocurrency wallets. CISA listed the flaw as exploited that day. As at 3 November, fixes cover both affected branches, but updating alone does not remove stolen credentials or existing intruders. The reviewed sources do not establish that the wider attacks have ended.

What
Flaw
Affects
SimpleHelp remote support and remote monitoring and management server
Affected
SimpleHelp 5.5.0 to 5.5.15 with OIDC configured, an associated TechnicianGroup, and “Allow group authenticated logins” enabled
SimpleHelp 6.0 pre-release versions before 6.0 RC2 with the same OIDC and TechnicianGroup configuration
Fixed in
SimpleHelp 5.5.16
SimpleHelp 6.0 RC2
CVE
CVE-2026-48558
Since
29 June 2026
Closed
30 June 2026

Timeline

  1. Update

    The Canadian Centre for Cyber Security urged administrators to apply the available updates following CISA’s listing.

  2. CISA added

    CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalogue, confirming use in real attacks.

  3. Wider attacks

    Blackpoint Cyber reported an intrusion it investigated and contained in which attackers used the flaw to gain technician access and deploy TaskWeaver and Djinn Stealer across managed computers.

  4. Made public

    Horizon3.ai publicly disclosed CVE-2026-48558 and published indicators administrators could use to investigate suspicious technician accounts.

  5. New fixFixed

    SimpleHelp released 5.5.16 and 6.0 RC2 to fix the vulnerability in its stable and pre-release branches.

  6. UpdateNo fix yet

    Horizon3.ai discovered the authentication bypass and validated it in real-world environments. It reported the flaw to SimpleHelp on 22 May.

Sources

  1. SimpleHelp 5.5 and 6.0 Security FixSimpleHelp · 26 May 2026
  2. Release NewsSimpleHelp
  3. CVE-2026-48558: What You Need to Know About the SimpleHelp OIDC Authentication BypassSimpleHelp
  4. A Djinn in the Machine: TaskWeaver’s Node.js Intrusion ChainBlackpoint Cyber · 29 June 2026
  5. SimpleHelp bug lets hackers create rogue remote support accountsBleepingComputer · 15 June 2026
  6. SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558)Help Net Security · 30 June 2026
  7. SimpleHelp security advisory (AV26-642)Canadian Centre for Cyber Security · 30 June 2026
  8. CVE-2026-48558CVE Program · 12 June 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from June 2026 · JSON · RSS