Critical SimpleHelp Auth Bypass Exposes 14,000 Servers

Key Takeaways

• A critical authentication bypass flaw, identified as CVE-2026-48558, impacts SimpleHelp remote monitoring and management (RMM) servers.
• The vulnerability allows unauthenticated attackers to create high-privilege “Technician” accounts, even bypassing multi-factor authentication (MFA).
• Approximately 14,000 internet-facing SimpleHelp servers are currently exposed, with about 7.2% potentially configured to be vulnerable.
• A patch was released on June 9, 2026, and organizations are urged to update immediately.

Critical SimpleHelp Flaw Exposes Thousands of RMM Servers to Auth Bypass

A severe authentication bypass vulnerability, designated as CVE-2026-48558, has left nearly 14,000 internet-accessible SimpleHelp servers vulnerable to compromise. This flaw poses a significant risk to organizations leveraging the remote monitoring and management (RMM) platform, enabling unauthorized access and potentially extensive network infiltration.

The security vulnerability was uncovered by researchers at Horizon3.ai through their “Sua Sponte” autonomous research initiative, which employs AI-driven analysis to identify exploitable weaknesses in software. The flaw specifically impacts SimpleHelp deployments configured to use OpenID Connect (OIDC) authentication, including those integrated with services like Azure Active Directory.

How the Authentication Bypass Works

CVE-2026-48558 stems from inadequate validation of identity provider assertions during the OIDC authentication process. This critical oversight permits unauthenticated attackers to forge a new “Technician” account and log into the SimpleHelp system without needing legitimate credentials. Horizon3.ai noted that this bypass is possible even in environments protected by multi-factor authentication (MFA), as attackers can register their own authentication method during their initial unauthorized login, effectively neutralizing the MFA layer.

Once an attacker gains access as a Technician, they possess elevated privileges. These accounts are capable of accessing managed endpoints, executing scripts, and performing various administrative functions, presenting a direct path for lateral movement and compromise of critical systems within an organization’s network.

The vulnerability is exploitable under specific conditions commonly found in enterprise setups: OIDC authentication must be enabled, a TechnicianGroup must be linked to the OIDC provider, and group-authenticated logins must be permitted. These configurations increase the real-world applicability and threat posed by the flaw.

Scope of Exposure and Detection

The number of publicly exposed SimpleHelp servers has seen a substantial increase over the past year, growing from approximately 3,400 in early 2025 to nearly 14,000 by June 2026, according to Horizon3.ai’s reports. Further analysis indicates that around 7.2% of these systems are configured in a manner that renders them susceptible to this authentication bypass.

To detect potential compromise, administrators should meticulously review all technician accounts within their SimpleHelp interface, searching for any unfamiliar names or email addresses. Additionally, server logs should be scrutinized for anomalous activities, such as unauthorized technician registrations or unexpected configuration alterations. Relevant log files, including those located in the /opt/SimpleHelp/logs/ directory on the host system, may contain crucial evidence of malicious activity.

The vulnerability was discovered on May 21, 2026, reported to the vendor on May 22, 2026, and publicly disclosed on June 12, 2026. SimpleHelp released a patch addressing the issue on June 9, 2026, prior to the public advisory.

What You Should Do

• Apply Updates Immediately: Organizations must apply the latest security updates released by SimpleHelp without delay to patch CVE-2026-48558.
• Restrict Access: If immediate patching is not feasible, implement temporary mitigation by restricting technician login access based on IP address within SimpleHelp’s security settings.
• Monitor Accounts and Logs: Regularly audit technician accounts for any unfamiliar users and diligently review server logs for suspicious activities, unauthorized registrations, or configuration changes.
• Review OIDC Configuration: Evaluate OIDC authentication settings to ensure that unnecessary group-authenticated logins are disabled if not critical for operations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.