Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

SimpleHelp bug lets attackers bypass login and take admin control

Part of the CVE-2026-48558 story · since 13 Jun

Quiet for 17 weekslast report 6 Jul11 articles8 outlets
13 Jun · SecurityOnline first23 Aug16 Sep10 OctNowThis article1st of 11
  • Sat 13 Jun, 04:17 UTC. SecurityOnline, first report. SimpleHelp bug lets attackers bypass login and take admin control. Cites a CVE in CISA KEV. This article, 1st of 11.
  • Mon 29 Jun, 22:28 UTC. Dark Reading, its first report on the story. Djinn malware exploits SimpleHelp flaw to steal AI credentials. Cites a CVE in CISA KEV.
  • Mon 29 Jun, 22:32 UTC. CISA, its first report on the story. SimpleHelp Auth Bypass Flaw (CVE‑2026‑48558) Grants Tech Access. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 02:30 UTC. SecurityOnline. SimpleHelp Authentication Bypass Exploited in the Wild to Deploy TaskWeaver and Djinn Stealer. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 09:01 UTC. SecurityWeek, its first report on the story. CVE-2026-48558 SimpleHelp flaw lets attackers deploy malware. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 10:44 UTC. SOCRadar, its first report on the story. SimpleHelp auth bypass lets hackers deploy Djinn Stealer. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 12:02 UTC. The Hacker News, its first report on the story. Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 16:13 UTC. Infosecurity, its first report on the story. Critical SimpleHelp Vulnerability Exploited For Malware Delivery. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 20:11 UTC. Security Affairs, its first report on the story. U.S. CISA adds SimpleHelp flaw to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Wed 1 Jul, 09:21 UTC. SecurityOnline. Claude Code Telemetry Rollback: Anthropic Responds to Backdoor Allegations. Cites a CVE in CISA KEV.
  • Mon 6 Jul, 02:32 UTC. SecurityOnline. Weekly Threat Intelligence: The July 2026 Breaches. Cites a CVE in CISA KEV.

A critical vulnerability identified as CVE-2026-48558 in SimpleHelp remote management software poses serious security risks. This flaw allows unauthenticated attackers to bypass authentication mechanisms and gain administrative control. The vulnerability is linked to failures in the application's OIDC authentication flow, where manipulated identity tokens can be accepted without verification.

As a result, an attacker can obtain unauthorized access to technician accounts, sidestep multi-factor authentication (MFA), and potentially execute malicious scripts within corporate environments. Exposed servers running vulnerable configurations have surged from 3,400 to nearly 14,000 globally. To mitigate risks, organizations are advised to apply software patches and implement strict network controls like IP restrictions to prevent unauthorized access.

How the story developed

All 11 articles
Quiet for 17 weekslast report 6 Jul11 articles8 outlets

11 articles from 8 outlets since 13 Jun. Quiet since 6 Jul. This was the first report.

Now13 Jun171921232629246First reportSecurityOnline · 13 Jun, 04:17CISA alert29 Jun, 22:32 · official
  • Sat 13 Jun, 04:17 UTC. SecurityOnline, first report. SimpleHelp bug lets attackers bypass login and take admin control. Cites a CVE in CISA KEV. This article, 1st of 11.
  • Mon 29 Jun, 22:28 UTC. Dark Reading, its first report on the story. Djinn malware exploits SimpleHelp flaw to steal AI credentials. Cites a CVE in CISA KEV.
  • Mon 29 Jun, 22:32 UTC. CISA, its first report on the story. SimpleHelp Auth Bypass Flaw (CVE‑2026‑48558) Grants Tech Access. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 02:30 UTC. SecurityOnline. SimpleHelp Authentication Bypass Exploited in the Wild to Deploy TaskWeaver and Djinn Stealer. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 09:01 UTC. SecurityWeek, its first report on the story. CVE-2026-48558 SimpleHelp flaw lets attackers deploy malware. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 10:44 UTC. SOCRadar, its first report on the story. SimpleHelp auth bypass lets hackers deploy Djinn Stealer. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 12:02 UTC. The Hacker News, its first report on the story. Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 16:13 UTC. Infosecurity, its first report on the story. Critical SimpleHelp Vulnerability Exploited For Malware Delivery. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 20:11 UTC. Security Affairs, its first report on the story. U.S. CISA adds SimpleHelp flaw to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Wed 1 Jul, 09:21 UTC. SecurityOnline. Claude Code Telemetry Rollback: Anthropic Responds to Backdoor Allegations. Cites a CVE in CISA KEV.
  • Mon 6 Jul, 02:32 UTC. SecurityOnline. Weekly Threat Intelligence: The July 2026 Breaches. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 11 articles as a list
  1. Sat 13 JunDay 01
    1. SimpleHelp bug lets attackers bypass login and take admin control04:17 · SecurityOnline · First report · Exploited CVE · Known exploited CVE · This article, 1st of 11

  2. Quiet for 2 weeks

    Mon 29 JunDay 162
    1. Djinn malware exploits SimpleHelp flaw to steal AI credentials22:28 · Dark Reading · Picked up again · Known exploited CVE
    2. SimpleHelp Auth Bypass Flaw (CVE‑2026‑48558) Grants Tech Access22:32 · CISA · official · CISA alert · Known exploited CVE
  3. Tue 30 JunDay 176
    1. SimpleHelp Authentication Bypass Exploited in the Wild to Deploy TaskWeaver and Djinn Stealer02:30 · SecurityOnline · Known exploited CVE
    2. CVE-2026-48558 SimpleHelp flaw lets attackers deploy malware09:01 · SecurityWeek · Known exploited CVE
    3. SimpleHelp auth bypass lets hackers deploy Djinn Stealer10:44 · SOCRadar · Known exploited CVE
    Show 3 more from 30 Jun
    1. Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer12:02 · The Hacker News · Known exploited CVE
    2. Critical SimpleHelp Vulnerability Exploited For Malware Delivery16:13 · Infosecurity · Known exploited CVE
    3. U.S. CISA adds SimpleHelp flaw to its Known Exploited Vulnerabilities catalog20:11 · Security Affairs · Known exploited CVE
  4. Wed 1 JulDay 181
    1. Claude Code Telemetry Rollback: Anthropic Responds to Backdoor Allegations09:21 · SecurityOnline · Known exploited CVE

  5. Quiet for 5 days

    Mon 6 JulDay 231
    1. Weekly Threat Intelligence: The July 2026 Breaches02:32 · SecurityOnline · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in