SimpleHelp MFA Bypass Exploited with Critical 10.0 CVSS Score

By Alec Chizhik · July 2, 2026 · 8 min read

On June 29, the U.S. agency CISA set a deadline for July 2. Three days for anyone running a SimpleHelp server exposed to the internet. The reason: a vulnerability with a CVSS score of 10.0-the maximum. CVE-2026-48558 completely bypasses authentication, multi-factor included, without attackers needing a single password.

Key Takeaways

Authentication bypass with CVSS 10.0: When OIDC is enabled, SimpleHelp fails to validate the signature of identity tokens. A forged token is all it takes to gain a fully authenticated technician session.
MFA neutralized: During first login, technicians register their own second factor. Attackers simply register their own instead.
Actively exploited: Threat actors are using this flaw to distribute two new malware strains, TaskWeaver and Djinn Stealer. CISA’s deadline for federal agencies was July 2.
MSPs in the crosshairs: RMM servers sit at the heart of hundreds of client networks for IT service providers. A compromised server is a master key.

What CVE-2026-48558 Actually Breaks

This vulnerability lies in a spot that comes up in every basic security course. When OIDC authentication is enabled, SimpleHelp accepts identity tokens without verifying their cryptographic signature. In vulnerability taxonomy, this is CWE-347: “Improper Verification of Cryptographic Signature.” In plain terms, the server believes any ID you show it without checking the watermark.

An unauthenticated attacker from anywhere on the internet can craft a token claiming to belong to an authorized Technician group. SimpleHelp lets them through and, if needed, even creates a new technician account. The prerequisite is a common real-world configuration: OIDC enabled, a TechnicianGroup linked to the provider, and the “Allow group authenticated logins” option turned on.

What about the second line of defense-MFA? It doesn’t help here. Even if the server enforces MFA for technicians, a technician can register their own second factor on first login. The attacker exploits this exact window and enrolls their own authenticator app. The lock is new, but they’ve cut their own key.

Why RMM Servers Are Such an Attractive Target

SimpleHelp is a remote monitoring and management (RMM) tool. IT service providers and in-house admin teams use it to control their clients’ or branch locations’ computers remotely. Whoever gains control of this server isn’t just inside a single network-they’re at the junction box for many.

That’s precisely what makes this vulnerability so troubling for managed service providers (MSPs) in the DACH region (Germany, Austria, Switzerland). A single compromised RMM server can potentially open the door to cloud consoles, DevOps pipelines, and the credentials behind them. The attacker doesn’t need to breach each customer individually-they take over the provider and inherit its entire reach.

Just how large this exposed attack surface is was examined by Horizon3.ai. Of roughly 14,000 SimpleHelp servers accessible on the internet, about 7.2% were configured with the vulnerable OIDC variant as of June 2026, according to their data. While that may sound like a small percentage, for a tool designed to sit deep within third-party networks, even one such server is one too many.

10.0

MAXIMUM CVSS SCORE FOR CVE-2026-48558

Around 14,000 SimpleHelp servers were exposed on the internet in June. Approximately 7.2% of these were running the vulnerable OIDC configuration, per Horizon3.ai. CISA remediation deadline for federal agencies: July 2, 2026.

Attackers Introduce Two New Malware Strains

On June 29, Blackpoint Cyber’s Adversary Pursuit Group raised the alarm. The team observed an unknown threat actor exploiting a vulnerability in a publicly accessible SimpleHelp server, hijacking a technician session, and deploying malware through it.

Two malware families emerged for the first time in this attack. TaskWeaver is a heavily obfuscated Node.js loader disguised as a harmless jquery.js file. In the second stage, it fetches Djinn Stealer-a cross-platform infostealer targeting Windows, macOS, and Linux. A stealer on an RMM (remote monitoring and management) server is a worst-case scenario: it harvests the very credentials MSPs (managed service providers) use to access other systems.

Check Immediately If You Already Have an Unwanted Guest

A patch closes the door-but it won’t tell you if someone already walked in. That’s why you need to run a compromise check before or alongside the update. Horizon3.ai points to specific places to look.

In the interface: Go to Administration → Technicians, click the gear icon, and enable “Show Group Authenticated Users.” Then review the list. Any unfamiliar name or unknown email address should set off alarms.

In the logs: Server logs are stored under Administration → Server Logs and on the filesystem at /opt/SimpleHelp/logs/server.log, plus in dated subdirectories. Look for entries like Registering technician login for [unknown-email] and Configuration save requested tied to unfamiliar technicians. That’s the calling card of a freshly created rogue session.

What Needs to Be on Your To-Do List Now

Order matters. First reduce exposure, then patch properly, then clean up forensically.

Patching: Upgrade to SimpleHelp 5.5.16, or to RC2 or the final 6.0 release in the 6.0 branch. The vendor closed the vulnerabilities back in late May.
Immediate workaround if patching stalls: Temporarily disable OIDC and set IP restrictions for technician logins under Administration → Login Security.
Check exposure: Does the RMM server really need to be exposed to the open internet? In most environments, access via VPN or a fixed IP allowlist is sufficient.
Audit accounts: Cross-check all technician accounts against your master list, remove any unauthorized entries, and reset their MFA registrations.
Harden processes: Review every authentication integration to ensure it properly validates token signatures. This vulnerability is a pattern, not an isolated case.

For operators within the scope of NIS2 (the EU’s Network and Information Security Directive), this incident has an additional dimension. Unauthorized access to an RMM server that controls customer networks constitutes a reportable security incident. The 24-hour reporting clock starts ticking from the moment of awareness-not the end of the workday. Those who take compromise checks seriously will likely know sooner whether they need to report.

Here is the translated HTML, adhering to all specified rules:

Frequently Asked Questions

Each question is closed. Tap to reveal the answer.

Am I affected if I use SimpleHelp without OIDC?

The bypass described here relies on OIDC login with group-based authentication. If you don’t use OIDC, this specific attack path doesn’t affect you. However, the update is still strongly recommended, as the patched versions close the vulnerability entirely and reduce the known attack surface.

Is the patch enough, or do I need forensic analysis too?

The patch prevents future unauthorized access, but it won’t remove an attacker who has already gained entry. For actively exploited vulnerabilities, a compromise assessment is always essential: look for unknown technician accounts, suspicious log entries, and injected files-such as a tampered jquery.js.

Why doesn’t my enforced MFA protect me here?

SimpleHelp allows technicians to register their own second factor during first login. An attacker exploiting the auth bypass can create a new technician identity and enroll their own MFA device. While MFA is mandatory, it doesn’t protect against accounts the attacker creates themselves.

What do TaskWeaver and Djinn Stealer have to do with this vulnerability?

They are the payloads observed in real-world attacks. After hijacking a technician session, attackers deployed TaskWeaver-a disguised Node.js loader-that subsequently downloads Djinn Stealer. This malware harvests credentials on Windows, macOS, and Linux systems. On an RMM server, this means access to the keys for many additional systems.

The CISA deadline was July 2. Does this affect me as a German company?

The deadline formally applies to U.S. federal agencies under CISA’s Binding Operational Directive. However, the urgency is universal: an actively exploited vulnerability with a CVSS score of 10.0 on an RMM server is a critical incident everywhere. For operators subject to NIS2 (the EU’s Network and Information Security Directive), an actual breach would also trigger mandatory reporting requirements.