SimpleHelp is remote support software, and a technician session on it can open a remote desktop on managed machines and run scripts on them. On 29 June 2026 CISA added CVE-2026-48558 to the Known Exploited Vulnerabilities catalog, with a deadline of 2 July.
The flaw is in the OpenID Connect login flow. The server accepted identity tokens without checking their cryptographic signature, so an attacker could forge one with any identity they liked.
What's affected
SimpleHelp 5.5.15 and earlier, plus the 6.0 pre-release builds. The fixes are SimpleHelp 5.5.16 for the 5.5 line and 6.0 RC2 for 6.0, per the vendor's security update notice. NVD scores it 10.0 on CVSS 3.1, and the weakness is CWE-347, improper verification of a cryptographic signature.
Horizon3.ai, which found the bug, says three conditions must all hold:
- At least one OIDC provider is configured.
- A TechnicianGroup has that provider enabled.
- "Allow group authenticated logins" is on for that group.
The vendor notes that not every server can be exploited. Horizon3.ai reports that internet exposed SimpleHelp servers grew from about 3,400 in January 2025 to nearly 14,000, and that about 7.2% of a random sample used the vulnerable setup.
Because technicians register their own MFA method on first login, the bug can also get around MFA.
How to check if you're exposed
Confirm the version in the admin console or on disk, then check the three settings. To look for rogue accounts, Horizon3.ai gives these steps:
- In Administration, then Technicians, open the gear icon and enable "Show Group Authenticated Users". Look for names or emails you do not recognize.
- Search the server logs for "Registering technician login for" and "Configuration save requested", especially with actors named "Forged Attacker" or "New Anon".
grep -E 'Registering technician login for|Configuration save requested' \
/opt/SimpleHelp/logs/server.log /opt/SimpleHelp/logs/*/server.log
The timeline from Horizon3.ai is short. The bug was found on 21 May 2026 and reported to the vendor the next day. On 9 June the authors saw that SimpleHelp had already shipped patches, and they published on 12 June. CISA listed the flaw 17 days after that.
What to do now
- Update to 5.5.16 or 6.0 RC2 and verify the download against the published SHA256 hashes.
- If you cannot update today, restrict technician login source addresses under Administration, then Login Security.
- Turn off "Allow group authenticated logins" where you do not need it.
- Audit technicians, scripts and configuration changes since late May 2026. Remove accounts you cannot explain.
- If you find a rogue technician, treat every endpoint that server manages as exposed.
How this could have been avoided
- Verify the signature on every identity token. The whole bug is one missing check. Use a maintained OIDC library, validate
iss,aud, expiry and the signing key, and write a test that sends a token with a bad signature. - Keep the support server off the open internet. A VPN or IP allowlist for technician logins would have made forged tokens unreachable.
- Do not enable convenience options by default. The exploitable setups needed "Allow group authenticated logins", which Horizon3.ai found commonly on.
- Alert on technician creation. A new technician identity should page someone. The logs already recorded the registrations.
Why it matters
Remote support tools are a favourite target because one login reaches many machines. A signature bypass in that login makes the tool a deployment channel for whatever the attacker wants to run.
Quick check
Which SimpleHelp versions fix CVE-2026-48558?
5.5.16 for the 5.5 line and 6.0 RC2 for the 6.0 pre-release.
What is the core mistake?
The server accepted OIDC identity tokens without verifying their cryptographic signature, so forged claims were trusted.
