CVE-2026-48558 SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a...

CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday added four vulnerabilities impacting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X series routers to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The list of...

CVE-2025-36727

Inclusion of Functionality from Untrusted Control Sphere vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.12...

CVE-2025-36727

Inclusion of Functionality from Untrusted Control Sphere vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.12...

CVE-2025-36727 SimpleHelp Inclusion of functionality from untrusted control sphere

Inclusion of Functionality from Untrusted Control Sphere vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.12...

CVE-2025-36727 SimpleHelp Inclusion of functionality from untrusted control sphere

Inclusion of Functionality from Untrusted Control Sphere vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.12...

CVE-2025-36727

CVE-2025-36727 — SimpleHelp is affected in versions before 5.5.12 due to the inclusion of functionality from an untrusted control sphere. The issue enables remote code execution and authentication bypass, allowing an attacker to execute arbitrary commands on a vulnerable system. Reported details ...

SimpleHelp < 5.5.12 RCE

The version of SimpleHelp running on the remote web server is prior to 5.5.12. It is, therefore, affected by a remote code execution vulnerability due to the inclusion of functionality from an untrusted control sphere. An attacker can use this to bypass authentication and execute arbitrary...

SimpleHelp < 5.5.11 XSRF

The version of SimpleHelp running on the remote web server is prior to 5.5.11. It is, therefore, affected by a cross-site request forgery XSRF vulnerability. Note that this vulnerability can be used in conjunction with CVE-2025-36727 to fully compromise a target. Note that Nessus has not tested f...

CVE-2024-57726

SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role...

SimpleHelp Unauthenticated Path Traversal

SimpleHelp versions 5.5.x 5.5.8, 5.4.x 5.4.10 and 5.3.x 5.3.9 suffer from an unauthenticated path traversal vulnerability. By crafting a specific URL, a remote and unauthenticated attacker can access sensitive file such as 'serverconfig.xml' which contains at least the SimpleHelpAdmin user hashed...

PT-2025-7246 · Unknown · Simplehelp

Name of the Vulnerable Software and Affected Versions: SimpleHelp affected versions not specified Description: A vulnerability has been identified in SimpleHelp. CISA has added this issue to the KEV Catalog. Recommendations: At the moment, there is no information about a newer version that contai...

SimpleHelp 安全漏洞

SimpleHelp is a remote support software from SimpleHelp, Inc. A security vulnerability exists in SimpleHelp 5.5.7 and earlier versions that originates from the ability of an administrator user to upload arbitrary files anywhere on the file system by uploading specially crafted zip files, which...

PT-2025-1272

Name of the Vulnerable Software and Affected Versions SimpleHelp remote support software versions 5.5.7 and before Description The issue allows low-privileges technicians to create API keys with excessive permissions, which can be used to escalate privileges to the server admin role. Attackers ca...

CVE-2024-57726

SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role...

PT-2025-1273

Name of the Vulnerable Software and Affected Versions SimpleHelp versions 5.5.7 and earlier Description SimpleHelp remote support software is affected by multiple path traversal vulnerabilities. These flaws allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp hos...