SimpleHelp CVE-2026-48558: Max-Severity Auth Bypass Dropping Djinn Stealer Through MSPs. Patch to 5.5.16 Now

SimpleHelp CVE-2026-48558 is a maximum-severity (CVSS 10.0) authentication bypass in the SimpleHelp remote support and RMM platform that lets an unauthenticated attacker forge a fully privileged technician session over the internet. Because a technician account can remote into every managed endpoint and run scripts on it, a single vulnerable server becomes a launchpad into every downstream machine it manages. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, and attackers are already using it to deploy the Djinn Stealer infostealer. If you run SimpleHelp, the fix is to update to 5.5.16 or 6.0 RC2 immediately and audit for rogue technician accounts.

What is CVE-2026-48558?

CVE-2026-48558 is an authentication bypass in SimpleHelp, the Java-based remote support software used by IT teams and managed service providers to remote into customer machines. NVD scores it 10.0 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H and classifies it as CWE-347: Improper Verification of Cryptographic Signature. In plain terms: SimpleHelp accepts an OpenID Connect (OIDC) identity token during login without properly checking that the token's cryptographic signature is genuine. A remote attacker can hand-craft a token with arbitrary identity claims, present it to an internet-facing SimpleHelp server, and be issued a valid technician session: no password, no prior access. It was published on 12 June 2026 and carries the highest severity rating the CVSS scale allows.

Why does it rate a perfect 10.0?

Three things stack up to the maximum score. First, it is remotely exploitable with no authentication and no user interaction, so anyone who can reach the login page can attempt it. Second, the scope is "changed" — the bug in the OIDC layer grants control over the whole management server, not just one account. Third, a forged technician is highly privileged by default: it can open remote sessions, execute scripts, and change configuration on managed endpoints. According to Horizon3.ai, which disclosed the issue, the exposure hinges on OIDC being enabled with a TechnicianGroup tied to the identity provider and "allow group authenticated logins" turned on. Worse, a freshly forged technician can self-register its own multi-factor method on first login, so MFA does not stop the bypass. A missing signature check on a single token type ends in unauthenticated remote code execution across an entire fleet, and that is what a 10.0 looks like.

Which SimpleHelp versions are affected?

The flaw affects SimpleHelp 5.5.15 and every earlier release, plus 6.0 pre-release builds. The vendor shipped fixed builds that correctly verify OIDC token signatures on 9 June 2026, ahead of public disclosure.

Item	Detail
CVE	CVE-2026-48558
CVSS v3.1	10.0 (Critical)
Weakness	CWE-347 — Improper Verification of Cryptographic Signature
Affected	SimpleHelp ≤ 5.5.15 and 6.0 pre-release builds
Fixed in	5.5.16 (v5.5.x branch) · 6.0 RC2 (v6.0 branch)
Status	On CISA KEV; actively exploited

The vendor's security update directs v5.5.x users to 5.5.16 and v6.0 users to 6.0 RC2 or later, and notes that not every server configuration is exploitable — but treat any internet-reachable, pre-patch server as at risk.

From auth bypass to Djinn Stealer: the attack chain

This is not theoretical. Active exploitation was reported by BlackPoint Cyber on 29 June 2026, and Help Net Security documented the payload the next day. After forging a technician session, attackers push a heavily obfuscated JavaScript file named jquery.js and run it through Node.js on the target. That loader, tracked as TaskWeaver, pulls down Djinn Stealer, an infostealer that sweeps cloud credentials, SSH keys, cryptocurrency wallets, browser data, and even authentication tokens for AI development tools, across Windows, macOS, and Linux endpoints. The Hacker News reported the same campaign. The point of entry is legitimate remote-management tooling, so the malicious sessions look like ordinary technician activity — which is exactly why it slips past defenders watching for unusual logins rather than unusual technicians.

The MSP multiplier: why this is worse than a normal CVE

Here is the angle the CVE trackers underplay. SimpleHelp is management software, and a lot of it runs at managed service providers who use one console to support hundreds of client companies. Compromising a single MSP's SimpleHelp server does not yield one victim — it yields every business that MSP supports, each reachable through an already-trusted remote channel. That is the same blast-radius math behind the software supply-chain attacks we covered in the Shai-Hulud npm crisis: break one upstream node, inherit all of its downstream trust. RMM platforms have become a favorite initial-access vector for ransomware crews precisely because they sit above the endpoints with god-mode privileges and blend into normal IT operations. If you are a business that outsources IT, this CVE is your problem too: ask your provider, in writing, whether their SimpleHelp instance was patched before 29 June and whether they found any rogue technician accounts.

How to check whether you were hit

Patching stops future exploitation but does not evict an attacker who already got in, so assume-breach and hunt. In the SimpleHelp console, open Administration → Technicians, click the gear icon, and enable Show Group Authenticated Users to reveal technicians created through the OIDC path; an unfamiliar entry there is a red flag. Per Horizon3.ai, check /opt/SimpleHelp/logs/server.log and its dated subdirectories for lines reading Registering technician login for followed by an email address you do not recognize, plus any configuration changes made by unknown technicians. On managed endpoints, look for a stray jquery.js executed via Node.js and for outbound connections tied to credential theft. If you find any of these, treat every credential reachable from affected machines — cloud keys, SSH keys, browser sessions, wallets — as compromised and rotate them.

How to fix it

The remediation is short and urgent:

• Update now. Move v5.5.x servers to 5.5.16 and v6.0 servers to 6.0 RC2 or later. These builds verify the OIDC token signature correctly.
• Get the admin surface off the open internet. Restrict access to the SimpleHelp interface to trusted management networks. Putting it behind a private mesh VPN like Tailscale, or enforcing IP allow-lists under Administration → Login Security, removes the unauthenticated internet exposure the exploit depends on.
• Audit and rotate. Remove any technician you cannot account for, then rotate secrets on managed endpoints as above.
• Mind the deadline. CISA placed CVE-2026-48558 on the KEV catalog under Binding Operational Directive 26-04, requiring US federal civilian agencies to remediate by 7 July 2026. It is a sensible bar for everyone else, and it has already passed — this should be done, not scheduled.

Reducing internet-facing attack surface is the durable lesson here, and it lines up with the zero-trust access model we compared against traditional VPNs: never expose a privileged admin plane directly to the world.

FAQ

Is CVE-2026-48558 being actively exploited? Yes. CISA added it to the Known Exploited Vulnerabilities catalog, and security vendors reported in-the-wild exploitation from late June 2026, with attackers using it to deploy the TaskWeaver loader and Djinn Stealer infostealer.

What versions of SimpleHelp fix it? SimpleHelp 5.5.16 fixes the v5.5.x branch and 6.0 RC2 fixes the v6.0 branch. Every version up to and including 5.5.15, plus 6.0 pre-release builds, is vulnerable.

Does multi-factor authentication protect me? No. A forged technician account created through the bypass can self-register its own MFA method on first login, so MFA enforcement does not block the attack. Patching and removing internet exposure are the real fixes.

I use an MSP, not SimpleHelp directly. Am I exposed? Possibly. If your provider used a vulnerable SimpleHelp server to manage your machines, an attacker who compromised that server could have reached your endpoints. Ask your provider to confirm they patched to 5.5.16/6.0 RC2 and audited for rogue technician accounts.

What is the CVSS score? NVD rates it 10.0, the maximum, because it is a remote, unauthenticated, no-interaction bypass whose scope extends to full control of the management server and its managed endpoints.

Sources

• NVD — CVE-2026-48558 — official CVSS 10.0 score, vector, CWE-347, and affected/fixed versions
• SimpleHelp — Security Update (2026-05) — vendor advisory naming fixed builds 5.5.16 and 6.0 RC2
• Horizon3.ai — SimpleHelp Auth Bypass IOCs — disclosure, exploit conditions, and indicators of compromise
• Help Net Security — SimpleHelp vulnerability exploited — active exploitation, TaskWeaver loader, Djinn Stealer, CISA deadline
• The Hacker News — Attackers exploit SimpleHelp CVE-2026-48558 — campaign reporting and payload analysis