CVE-2026-4855810.0CriticalCWE-347
SimpleHelp Authentication Bypass Vulnerability
Exploited in the wild · in CISA KEV since 29 JunVendor fix available
77.7%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
10.0CriticalCVSS 4.0
LowMediumHighCrit.
Federal deadline
CISA KEV · added 29 Jun · catalogue entry
Passed 122 days ago
DescriptionNVD
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage10 articles · 8 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 13 Jun.
Quiet for 17 weekslast report 6 Jul10 articles8 outlets
- Sat 13 Jun, 04:17 UTC. SecurityOnline, first report. SimpleHelp bug lets attackers bypass login and take admin control. Cites a CVE in CISA KEV.
- Mon 29 Jun, 22:28 UTC. Dark Reading, its first report on the story. Djinn malware exploits SimpleHelp flaw to steal AI credentials. Cites a CVE in CISA KEV.
- Mon 29 Jun, 22:32 UTC. CISA, its first report on the story. SimpleHelp Auth Bypass Flaw (CVE‑2026‑48558) Grants Tech Access. Cites a CVE in CISA KEV.
- Tue 30 Jun, 02:30 UTC. SecurityOnline. SimpleHelp Authentication Bypass Exploited in the Wild to Deploy TaskWeaver and Djinn Stealer. Cites a CVE in CISA KEV.
- Tue 30 Jun, 09:01 UTC. SecurityWeek, its first report on the story. CVE-2026-48558 SimpleHelp flaw lets attackers deploy malware. Cites a CVE in CISA KEV.
- Tue 30 Jun, 10:44 UTC. SOCRadar, its first report on the story. SimpleHelp auth bypass lets hackers deploy Djinn Stealer. Cites a CVE in CISA KEV.
- Tue 30 Jun, 12:02 UTC. The Hacker News, its first report on the story. Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer. Cites a CVE in CISA KEV.
- Tue 30 Jun, 16:13 UTC. Infosecurity, its first report on the story. Critical SimpleHelp Vulnerability Exploited For Malware Delivery. Cites a CVE in CISA KEV.
- Tue 30 Jun, 20:11 UTC. Security Affairs, its first report on the story. U.S. CISA adds SimpleHelp flaw to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
- Mon 6 Jul, 02:32 UTC. SecurityOnline. Weekly Threat Intelligence: The July 2026 Breaches. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 13 Jun 04:17 | SecurityOnline | SimpleHelp bug lets attackers bypass login and take admin control |
| 29 Jun 22:28 | Dark Reading | Djinn malware exploits SimpleHelp flaw to steal AI credentials |
| 29 Jun 22:32 | CISA | SimpleHelp Auth Bypass Flaw (CVE‑2026‑48558) Grants Tech Access |
| 30 Jun 02:30 | SecurityOnline | SimpleHelp Authentication Bypass Exploited in the Wild to Deploy TaskWeaver and Djinn Stealer |
| 30 Jun 09:01 | SecurityWeek | CVE-2026-48558 SimpleHelp flaw lets attackers deploy malware |
| 30 Jun 10:44 | SOCRadar | SimpleHelp auth bypass lets hackers deploy Djinn Stealer |
| 30 Jun 12:02 | The Hacker News | Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer |
| 30 Jun 16:13 | Infosecurity | Critical SimpleHelp Vulnerability Exploited For Malware Delivery |
| 30 Jun 20:11 | Security Affairs | U.S. CISA adds SimpleHelp flaw to its Known Exploited Vulnerabilities catalog |
| 6 Jul 02:32 | SecurityOnline | Weekly Threat Intelligence: The July 2026 Breaches |
- Weekly Threat Intelligence: The July 2026 BreachesSecurityOnline
- SimpleHelp Auth Bypass Flaw (CVE‑2026‑48558) Grants Tech AccessCISA · official notice
- SimpleHelp bug lets attackers bypass login and take admin controlSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.