CISA Sets a July 2 Deadline as SimpleHelp Auth-Bypass Flaw CVE-2026-48558, Rated CVSS 10, Is Exploited to Deploy Djinn Stealer

Overview

The U.S. Cybersecurity and Infrastructure Security Agency added a critical authentication bypass flaw in SimpleHelp remote support software to its Known Exploited Vulnerabilities catalog on June 29, 2026, and ordered federal civilian agencies to patch it by July 2, according to Security Affairs. The vulnerability, tracked as CVE-2026-48558, carries a maximum CVSS v3.1 score of 10.0, per Security Affairs, and is already being used in the wild to steal credentials and deliver malware.

What We Know

SimpleHelp is a remote monitoring and management (RMM) platform. Arctic Wolf describes the issue as “a critical authentication bypass vulnerability in SimpleHelp Remote Monitoring and Management (RMM) software, caused by improper validation of OpenID Connect (OIDC) token signatures,” in its analysis. When OIDC authentication is configured, the application does not verify the cryptographic signature of identity tokens, allowing an unauthenticated attacker to submit a forged token during login, according to SecurityWeek.

The consequence is full technician-level access without credentials. Arctic Wolf writes that “unauthenticated attackers can forge identity tokens to bypass multi-factor authentication and gain privileged technician-level access to vulnerable SimpleHelp servers — without valid credentials,” in the same report. The flaw was found by Zach Hanley at Horizon3.ai through the firm’s “Sua Sponte” autonomous vulnerability research pipeline, according to Horizon3.ai, which publicly disclosed the issue on June 12, 2026. Horizon3.ai notes that the multi-factor authentication check can be sidestepped because “on first login, technicians can self-register their own MFA method,” in its disclosure.

SimpleHelp’s own advisory states that “SimpleHelp servers running versions 5.5.15 and earlier releases may be subject to a vulnerability,” per the vendor. Fixed builds are SimpleHelp 5.5.16 and 6.0 RC2, according to SecurityWeek. The vendor cautions that “not all servers can be exploited,” saying the flaw “can be exploited in specific conditions depending on the server’s settings and network context,” in its update.

Exploitation and Malware

BlackPoint Cyber researchers first observed attacks in the wild exploiting the vulnerability, according to Security Affairs. The firm’s Adversary Pursuit Group identified two previously undiscovered malware samples, TaskWeaver and Djinn Stealer, Security Affairs reports. SecurityWeek describes TaskWeaver as a Node.js loader used for system fingerprinting and deploying encrypted JavaScript payloads, and Djinn Stealer as “a cross-platform information stealer” that targets cloud credentials, SSH keys, infrastructure configurations, source control tokens, package registry authentication, development tooling, cryptocurrency wallets, and browser data, in its coverage.

Because RMM tools centralize remote access across large fleets of endpoints, a single compromised SimpleHelp server carries outsized risk for managed service providers, IT service organizations, and cloud providers, Arctic Wolf notes.

Exposure

Internet scans indicate approximately 14,000 SimpleHelp servers are externally exposed, with an estimated 1,000 directly vulnerable, according to Arctic Wolf. Security Affairs reports that exposed SimpleHelp servers have risen from about 3,400 in January 2025 to nearly 14,000, of which around 7.2% were found configured with the vulnerable OIDC authentication method, in its writeup. Cyber Security News likewise reports “nearly 14,000 internet-facing SimpleHelp servers are exposed” following the disclosure, in its report.

The timeline preceded active exploitation reports by weeks. Cyber Security News states the vulnerability “was discovered on May 21, 2026, reported to the vendor the following day, and publicly disclosed on June 12, 2026,” with a patch released on June 9 ahead of the public advisory, according to its account.

What We Don’t Know

The cited reporting does not attribute the exploitation to a named nation-state or ransomware group, describing the activity through the malware samples and the BlackPoint Cyber telemetry rather than a formal threat-actor label. The total number of organizations affected downstream of compromised managed service providers is also not quantified in the sources reviewed.

Analysis

The federal remediation window here is unusually tight. CISA placed the flaw on its KEV catalog on June 29 and set a July 2 due date under Binding Operational Directive 26-04, a three-day patching mandate, according to SecurityWeek. That compression reflects both the maximum severity score and the leverage a single RMM compromise gives an attacker across every downstream customer a provider manages. This is a distinct flaw from the earlier SimpleHelp bugs CVE-2024-57726 and CVE-2024-57728, which CISA previously added to KEV and which the DragonForce ransomware operation chained; the same MSP-fanout risk now applies to a new authentication bypass. With a patch available since June and roughly 1,000 servers still assessed as vulnerable, the exposure gap is now an operational one rather than a question of whether a fix exists.