Critical SimpleHelp Auth Bypass Exposes 14, Nearly Servers

The disclosure of a critical authentication bypass vulnerability, tracked as CVE-2026-48558, has left nearly 14,000 internet-facing SimpleHelp servers exposed.

The flaw raises serious concerns for enterprises using the remote monitoring and management (RMM) platform.

Horizon3.ai identified the vulnerability through its autonomous research initiative “Sua Sponte,” which leverages AI-driven analysis to uncover exploitable flaws.

The issue affects SimpleHelp deployments configured with OpenID Connect (OIDC) authentication, including integrations with Azure Active Directory.

CVE-2026-48558 is caused by improper validation of identity provider assertions during the OIDC authentication process.

This flaw allows unauthenticated attackers to create a new “Technician” account and log in without valid credentials.

SimpleHelp Servers Exposed by Auth Bypass

Once inside, the attacker gains elevated privileges, as technician accounts can access managed endpoints, execute scripts, and perform administrative actions. Even environments protected by multi-factor authentication are not immune.

The vulnerability enables attackers to bypass MFA by registering their own authentication method during the first login, effectively nullifying this security layer.

The issue becomes exploitable in environments where OIDC authentication is enabled, a TechnicianGroup is linked to the OIDC provider, and group-authenticated logins are permitted.

These settings are commonly found in enterprise deployments, increasing the likelihood of exploitation in real-world scenarios.

To detect potential compromise, administrators should carefully review technician accounts within the SimpleHelp interface, specifically checking for unfamiliar names or email addresses.

Server logs should also be analyzed for suspicious activity, such as unauthorized technician registrations or unexpected configuration changes.

Log files stored on the host system, including those in the /opt/SimpleHelp/logs/ directory, may provide additional evidence of malicious activity.

The scale of exposure has grown significantly over the past year. Horizon3.ai reports that the number of publicly accessible SimpleHelp servers has increased from around 3,400 in early 2025 to nearly 14,000 as of June 2026.

Further analysis suggests that approximately 7.2% of these systems are configured in a way that makes them vulnerable to this authentication bypass.

Given SimpleHelp’s role in remote access and endpoint management, successful exploitation could allow attackers to move laterally across networks and compromise critical systems.

Organizations are strongly advised to apply the latest security updates released by SimpleHelp to remediate the vulnerability.

In cases where immediate patching is not possible, administrators should implement temporary controls, such as restricting technician login access based on IP address in the platform’s security settings.

The vulnerability was discovered on May 21, 2026, reported to the vendor the following day, and publicly disclosed on June 12, 2026. A patch was released on June 9, before the public advisory.

This disclosure underscores the ongoing risks associated with widely deployed RMM tools. It highlights the importance of securing authentication mechanisms, particularly when integrating with enterprise identity providers.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.