CVE-2026-48558: SimpleHelp OIDC — Remote Endpoint Hijack Risk (June 2026)

CVE-2026-48558 — SimpleHelp OIDC Authentication Bypass

CVE-2026-48558 is a critical vulnerability (CVSS 10.0) in SimpleHelp remote management software, actively exploited in the wild. Attackers can bypass authentication—including multi-factor authentication—by exploiting a flaw in the OIDC single sign-on flow, granting themselves full administrative access to SimpleHelp-managed endpoints.

Attack Vector

The vulnerability allows unauthenticated attackers to forge credentials during the OIDC SSO process, circumventing all authentication controls. No prior access or valid credentials are required. Once exploited, attackers can remotely execute management actions, deploy malicious scripts, and access or control any endpoint managed by the affected SimpleHelp instance. The attack is effective against internet-facing servers and does not require user interaction.

Who Is at Risk

All organizations running SimpleHelp remote management software with OIDC SSO enabled are at risk, including SimpleHelp itself and enterprises using the platform for remote support or endpoint management. Approximately 7.2% of exposed SimpleHelp servers worldwide are vulnerable, with a recent surge in internet-facing instances. Any deployment with external access is a high-priority target.

Patch & Mitigate

• Patch: Apply the vendor's security update or hotfix for CVE-2026-48558 immediately. Check SimpleHelp advisories for the latest fixed versions.
• Workaround: If patching is not possible, disable OIDC SSO and restrict external access to SimpleHelp servers.
• Detect: Review authentication logs for anomalous or failed OIDC login attempts, especially from unfamiliar IP addresses. Monitor for unexpected administrative actions or new scripts deployed via the management console.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit the authentication bypass to gain a foothold in the environment.
• TA0006 — Credential Access: The flaw enables forging of credentials, bypassing normal authentication and MFA controls.

Source: https://securityonline.info/simplehelp-authentication-bypass