SimpleHelp Releases Advisory for Authentication Bypass Vulnerability in SimpleHelp RMM

Successful exploitation of CVE-2026-48558 could allow a remote, unauthenticated attacker to bypass authentication and gain full administrative “Technician” access to managed endpoints

Threat ID:: CC-4804
Threat Severity:: Medium
Published:: 30 June 2026 2:46 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation of CVE-2026-48558 could allow a remote, unauthenticated attacker to bypass authentication and gain full administrative “Technician” access to managed endpoints

Affected platforms

The following platforms are known to be affected:

SimpleHelp

All versions 5.5.x prior to 5.5.16

All pre-release versions 6.x prior to 6.0 RC2

Note: Exploitation only affects environments using OpenID Connect (OIDC) authentication within affected version.

Threat details

Exploitation of CVE-2026-48558

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-48558 to its Known Exploited Vulnerabilities (KEV) Catalog.

The NHS England National CSOC assesses further exploitation as highly likely.

Introduction

SimpleHelp has released security updates to address a critical vulnerability in its Remote Monitoring and Management platform. Successful exploitation could allow a remote, unauthenticated attacker to bypass authentication and gain full administrative “Technician” access to managed endpoints.

CVE-2026-48558 - "Improper Verification of Cryptographic Signature" vulnerability - CVSSv4 score: 9.5

Note: Exploitation only affects environments using OpenID Connect (OIDC) authentication within affected version.

Remediation advice

Affected organisations are encouraged to review security advisory SimpleHelp 5.5 and 6.0 Security Fix and apply the relevant update as soon as possible.

Definitive source of threat updates

https://simple-help.com/security/simplehelp-security-update-2026-05

CVE Vulnerabilities

Status Published

CVE-2026-48558

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.

Last edited: 30 June 2026 2:46 pm