What This Is
CVE-2026-48558 is a CVSS 10.0 authentication bypass in SimpleHelp, a remote monitoring and management (RMM) platform widely used by IT support teams and managed service providers to administer endpoints across client environments. When SimpleHelp is configured to use OpenID Connect (OIDC) authentication, it accepts identity tokens without verifying their cryptographic signatures. An unauthenticated attacker can forge a token, present it to the server, and receive a fully authenticated Technician session — complete with access to every endpoint the RMM manages.
CISA added this to the Known Exploited Vulnerabilities catalog on June 29, 2026 with a three-day remediation deadline under BOD 26-04. Exploitation in the wild was confirmed by Blackpoint Cyber before the deadline arrived. Attackers are using compromised SimpleHelp servers to deploy TaskWeaver (an obfuscated Node.js loader) and Djinn Stealer (targeting cloud credentials, SSH/Git keys, browser data, and AI coding assistant tokens).
This is a supply chain attack. One vulnerable SimpleHelp server gives an attacker trusted administrative access to every endpoint under management — with no credentials, no phishing, no lateral movement required. If you run SimpleHelp for clients, you are the target.
CVE Details
CVE: CVE-2026-48558
CVSS v3.1: 10.0 CRITICAL
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CISA KEV: Yes — added June 29, 2026. Deadline July 2, 2026 (BOD 26-04)
Affected: SimpleHelp server with OIDC authentication enabled (generic OIDC or Azure AD OIDC with group-authenticated login)
Patch: SimpleHelp version released June 5, 2026
Authentication required: None
MFA bypass: Yes — even enforced MFA is bypassed because the OIDC flow allows self-registration of MFA device on first login
CVSS v3.1: 10.0 CRITICAL
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CISA KEV: Yes — added June 29, 2026. Deadline July 2, 2026 (BOD 26-04)
Affected: SimpleHelp server with OIDC authentication enabled (generic OIDC or Azure AD OIDC with group-authenticated login)
Patch: SimpleHelp version released June 5, 2026
Authentication required: None
MFA bypass: Yes — even enforced MFA is bypassed because the OIDC flow allows self-registration of MFA device on first login
How It Works
SimpleHelp's OIDC login flow accepts the identity token presented by the client without verifying the token's cryptographic signature against the identity provider. The server trusts the claims in the token as-is. An attacker who understands the expected token structure can forge a token with any identity claims — including claims that create a Technician account with administrative privileges — and the SimpleHelp server accepts it as legitimate.
The full attack chain documented by Blackpoint Cyber researchers Nevan Beal and Sam Decker runs as follows: forge a valid-looking OIDC token → present it to an internet-facing SimpleHelp server → receive a Technician session → use SimpleHelp's own file-transfer and remote-execution features to push malware to managed endpoints. The payload observed is a file named jquery.js (TaskWeaver, an obfuscated Node.js loader) fetched from a temporary Cloudflare-hosted address and executed via Node.js. TaskWeaver then deploys Djinn Stealer, which harvests credentials, browser data, SSH keys, cloud provider tokens, Git credentials, and configuration files for AI coding assistants.
Because the attacker operates as a legitimate Technician through the RMM platform, their activity appears as authorized support session traffic in logs. The malicious execution inherits the appearance of a normal administrative action.
Who Is Exposed
Any organization running SimpleHelp server with OIDC authentication configured — whether generic OIDC or Azure AD with group-authenticated login settings — and the server reachable from the internet. OIDC is not the default authentication method in SimpleHelp, but it is a common configuration in organizations using Azure AD or single-sign-on. If you are unsure whether OIDC is enabled, check Administration → Login Security in the SimpleHelp console.
MSPs running SimpleHelp are the highest-risk group. A single compromised SimpleHelp instance cascades into every downstream client environment the MSP manages.
Detection
Check for unexpected Technician accounts created via OIDC:
# In SimpleHelp admin console:
# Administration → Technicians
# Look for technician accounts you did not create.
# Attackers have been observed creating accounts named "John Sim"
# during automated reconnaissance. Any unrecognized account
# after the OIDC bypass window should be treated as IOC.
Hunt for TaskWeaver on managed endpoints (Windows):
# Search for the malicious jquery.js payload
Get-ChildItem -Path C:\ -Recurse -Filter "jquery.js" -ErrorAction SilentlyContinue |
Where-Object { $_.Length -gt 50KB } |
Select-Object FullName, Length, LastWriteTime
# Look for Node.js executing from unexpected paths
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match "node.exe" -and $_.Message -match "jquery.js" }
Check for SimpleHelp-initiated process execution:
# Look for processes spawned by SimpleHelp service
Get-WinEvent -LogName Security | Where-Object {
$_.Id -eq 4688 -and $_.Message -match "simplehelp"
} | Select-Object TimeCreated, Message | Format-List
Verify your SimpleHelp version:
# In SimpleHelp web interface:
# Administration → About
# Confirm the version is the June 5, 2026 patch or later.
# If the version is earlier than the patched release, assume exposure.
IOCs
Malware TaskWeaver — obfuscated Node.js loader
Filename jquery.js (masquerades as jQuery library)
Delivery path SimpleHelp file-transfer feature (looks like authorized support)
Execution node.exe jquery.js (executed via SimpleHelp remote execution)
Secondary Djinn Stealer — credential/token harvester
Rogue accounts "John Sim" technician account (automated recon sweep signature)
Network Outbound to Cloudflare-hosted temporary URLs for payload staging
Targets Browser credential stores, SSH keys, ~/.aws/credentials,
~/.gitconfig, AI coding assistant config files (Cursor, Copilot)
CISA KEV CVE-2026-48558 added June 29, 2026
Remediation
Step 1 — Patch immediately: Upgrade SimpleHelp server to the patched version (released June 5, 2026). Do not delay — public exploitation is active and the OIDC bypass requires no special knowledge or tooling.
Step 2 — If patching is not immediately possible, disable OIDC: Administration → Login Security → disable OIDC as an authentication method. Enforce local credentials with MFA until the patch is applied. Restrict internet-facing access via firewall or VPN.
Step 3 — Audit Technician accounts: Remove any accounts not recognized by your team. An unexpected account created in the OIDC flow window is an indicator of compromise, not just a misconfiguration.
Step 4 — Assume compromise if you were exposed: If your SimpleHelp server was internet-accessible with OIDC enabled before the patch, treat the server and all managed endpoints as potentially compromised. Hunt for TaskWeaver (jquery.js), review process execution logs from the exposure window, and rotate credentials on all managed systems — especially cloud provider tokens, SSH keys, and developer credentials.
Step 5 — Restrict internet exposure permanently: RMM consoles should not be internet-facing without VPN or IP allowlisting. SimpleHelp specifically should be firewalled to known technician IP ranges.
If you manage client environments via SimpleHelp and were exposed, this is a client notification event. Every endpoint under your management may have received TaskWeaver during the exposure window. Do not wait for confirmation before notifying clients and beginning endpoint review.
Sources & References
— CISA KEV Catalog — CVE-2026-48558
— The Hacker News — Attackers Exploit SimpleHelp CVE-2026-48558
— SOCRadar — CVE-2026-48558 Technical Analysis
— Arctic Wolf — Recommendations for CVE-2026-48558
— NVD — CVE-2026-48558
— MITRE ATT&CK — T1078 Valid Accounts
— The Hacker News — Attackers Exploit SimpleHelp CVE-2026-48558
— SOCRadar — CVE-2026-48558 Technical Analysis
— Arctic Wolf — Recommendations for CVE-2026-48558
— NVD — CVE-2026-48558
— MITRE ATT&CK — T1078 Valid Accounts
More like this, when it happens
Advisories only. No newsletter, no marketing, unsubscribe in one click.
Barr Cyber — MSP Auditing & Accountability
RMM platform security is a standard item in every Barr Cyber MSP audit. If your RMM tools are internet-facing, unpatched, or not monitored for unauthorized accounts, that is a gap that attackers are actively targeting. Contact Barr Cyber.
Get in Touch →