Vendor

SimpleHelp

Vulnerabilities and patches in SimpleHelp's remote-support server — an on-prem RMM/support tool whose compromise typically hands attackers pre-authenticated technician access to every endpoint enrolled behind it. Covered here because remote-support servers are a repeat target for ransomware crews and CISA has added multiple SimpleHelp flaws to its Known Exploited Vulnerabilities catalog.

CVEs

CVE-2026-48558

[ CRITICAL ] CVSS 10.0 EPSS 1.2% kev

SimpleHelp OIDC Authentication Bypass

SimpleHelp 5.5.15 and prior accepts OIDC identity tokens without verifying their signature — a forged token yields a full technician session. CVSS 10.0, KEV, patch is 5.5.16.

SimpleHelp / SimpleHelp Server Jun 29

Articles

~/articles/2026-07-09-simplehelp-cve-2026-48558-oidc-bypass-past-kev-deadline

● Breaking

simplehelp

SimpleHelp OIDC Auth Bypass Past CISA Deadline: Patch Now

SimpleHelp Server 5.5.15 and earlier accept forged OIDC tokens as valid technician sessions. CVSS 10.0, KEV, patch is 5.5.16 — CISA deadline was July 2.

Jul 9 read →