SimpleHelp remote support software: CVE-2024-57726 and CVE-2024-57728 used in attacks, fixed since 2025
CISA listed two SimpleHelp remote-support flaws (CVE-2024-57726, CVE-2024-57728) as exploited on 24 April 2026. Fixed in v5.5.8 and later. If you or your IT provider run SimpleHelp, update, change admin and technician passwords, and replace API keys.
If you run SimpleHelp, upgrade to version 5.5.8 or later (or apply the vendor patch for 5.4.10 or 5.3.9), then change administrator and technician passwords and create new API keys. If a managed IT provider looks after your devices, ask whether they use SimpleHelp and have done this.
What’s happening
SimpleHelp is remote support and monitoring software that IT providers run on a server to control customers' computers. Two flaws in versions 5.5.7 and earlier were added to CISA's list of flaws used in attacks on 24 April 2026. CVE-2024-57726 lets a low-privileged technician account create API keys that escalate to server administrator. CVE-2024-57728 lets an administrator upload a crafted zip file to write files anywhere on the server and run code as the SimpleHelp server user. SimpleHelp fixed the problems in 2025: version 5.5.8 or later, or patches for 5.4.10 and 5.3.9. Its notice also advises changing administrator and technician passwords and API tokens, and restricting logins by IP address. Reporting from 2025 describes ransomware actors, including DragonForce as seen by Sophos, using these flaws together with CVE-2024-57727 to reach customers of IT providers. The 2026 listing does not say a new fix was issued. Businesses and managed IT providers are most exposed; a family is affected only if its IT support uses SimpleHelp.
- What
- Flaw
- Affects
- SimpleHelp remote support and monitoring server
- Affected
- SimpleHelp 5.5.7 and earlier
- Fixed in
- SimpleHelp 5.5.8 or later
Patch for SimpleHelp 5.4.10
Patch for SimpleHelp 5.3.9 - Since
- 24 Apr 2026
- Closed
- 24 Apr 2026
Timeline
- CISA added
CISA added CVE-2024-57726 and CVE-2024-57728 to its catalogue of flaws used in attacks. A secondary summary lists both as exploited in the wild and affecting SimpleHelp 5.5.7 and earlier.
- Wider attacks
Reporting on a CISA advisory said ransomware actors had breached customers of a utility billing software provider through unpatched SimpleHelp. Sophos had seen DragonForce ransomware deployed in May 2025 using CVE-2024-57726, CVE-2024-57727 and CVE-2024-57728.
- Update
SimpleHelp's notice was updated to list the CVE identifiers, including CVE-2024-57726 and CVE-2024-57728. It advises upgrading to v5.5.8 or later, or applying the patch for v5.4.10 or v5.3.9, and changing administrator and technician passwords and API tokens.
- Made publicFixed
SimpleHelp published its security notice for versions 5.5.7 and earlier, starting with a patch for v5.3.9. Fixes followed in v5.5.8 and patches for v5.4.10 (reissued 31 January 2025).
Sources
- Security vulnerabilities in SimpleHelp 5.5.7 and earlierSimpleHelp · 12 Feb 2025
- Ransomware Gang Exploits SimpleHelp RMM to Compromise Utility Billing FirmInfosecurity Magazine · 13 June 2025
- CISA adds four known exploited vulnerabilities to catalog (2026-04-24)Aviatrix · 24 Apr 2026