SimpleHelp RMM Bug CVE-2026-48558 Lands on CISA KEV as Djinn Stealer Spreads
A critical OIDC authentication bypass in SimpleHelp remote monitoring servers is being actively exploited to drop Djinn Stealer, prompting CISA to add CVE-2026-48558 to the Known Exploited Vulnerabilities catalog.
Key Takeaways
CVE-2026-48558 is a CVSS 10.0 unauthenticated OIDC authentication bypass in SimpleHelp RMM that lets attackers forge identity tokens, skip MFA, and gain fully privileged Technician access to managed endpoints.
CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies a July 2 remediation deadline after exploitation began within two months of disclosure.
Attackers observed by Blackpoint are using the bypass to deploy TaskWeaver, a Node.js loader, and Djinn Stealer, a cross-platform infostealer targeting credentials, browser data, and crypto wallets.
Horizon3.ai, which found the bug with an autonomous AI vulnerability-hunting system, counted nearly 14,000 internet-exposed SimpleHelp servers, with about 7.2% using the vulnerable OIDC pathway (~1,000 exploitable instances).
Defenders should upgrade to SimpleHelp 5.5.16 or 6.0 RC2, disable OIDC group-authenticated login if patching isn't possible, and hunt for unexpected Technician accounts, sessions, and script runs from unfamiliar IPs.
Kaan Tınmaz
A critical, unauthenticated authentication bypass in SimpleHelp's remote monitoring and management (RMM) software has moved from disclosure to active exploitation in less than two months, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has now added it to its Known Exploited Vulnerabilities (KEV) catalog with a July 2 remediation deadline for federal civilian agencies.
What CVE-2026-48558 Actually Does
Tracked as CVE-2026-48558 and carrying a maximum CVSS score of 10.0, the flaw stems from SimpleHelp not verifying the cryptographic signature of OpenID Connect (OIDC) identity tokens on servers configured with group-authenticated logins. That gap lets an unauthenticated attacker forge an identity token, side-step multi-factor authentication and land as a fully privileged Technician account able to remote into any managed endpoint, execute scripts and exfiltrate data.
From Horizon3 Disclosure to Djinn Stealer
The bug was discovered by Horizon3.ai using an autonomous vulnerability-hunting AI system and disclosed after SimpleHelp shipped fixes in versions 5.5.16 and 6.0 RC2 in late May 2026. Within weeks, incident responders at Blackpoint observed a threat actor abusing the bypass to deploy two malware families on managed endpoints: TaskWeaver, a Node.js loader, and Djinn Stealer, a cross-platform infostealer targeting credentials, browser data and cryptocurrency wallets.
The Blast Radius
Internet scans by Horizon3.ai counted almost 14,000 SimpleHelp servers exposed to the public internet, with roughly 7.2% of a random sample configured to use the vulnerable OIDC pathway — leaving on the order of 1,000 directly exploitable instances at the time of disclosure. Because SimpleHelp is popular with MSPs and IT help desks, each successful compromise can cascade downstream into hundreds or thousands of customer endpoints, echoing the ransomware waves that followed earlier authentication-bypass flaws in remote support tooling.
What Defenders Should Do Now
SimpleHelp is urging customers to upgrade immediately, disable OIDC group-authenticated login if patching is not possible, and hunt for unexpected Technician account creation, sessions and script runs originating from unfamiliar IPs. Federal Civilian Executive Branch agencies faced a July 2 deadline to patch, and CISA has flagged the vulnerability alongside a wave of RMM-focused campaigns highlighted in its recent SharePoint RCE advisory.
Reporting based on coverage from Help Net Security, Horizon3.ai, Arctic Wolf, SecurityWeek and SimpleHelp's own advisories.
It is a critical (CVSS 10.0) authentication bypass in SimpleHelp RMM software. Servers configured with OIDC group-authenticated logins fail to verify the cryptographic signature of OpenID Connect identity tokens, letting an unauthenticated attacker forge a token, bypass MFA, and obtain a fully privileged Technician account.
How is the vulnerability being exploited in the wild?
Incident responders at Blackpoint observed a threat actor using the bypass to remote into managed endpoints and deploy two malware families: TaskWeaver, a Node.js loader, and Djinn Stealer, a cross-platform infostealer that harvests credentials, browser data, and cryptocurrency wallets.
How many SimpleHelp servers are at risk?
Horizon3.ai internet scans found almost 14,000 publicly exposed SimpleHelp servers, with roughly 7.2% of a sample using the vulnerable OIDC configuration, implying about 1,000 directly exploitable instances at disclosure. Since SimpleHelp is popular with MSPs, each compromise can cascade to hundreds or thousands of downstream endpoints.
What should organizations do to protect themselves?
Upgrade immediately to SimpleHelp 5.5.16 or 6.0 RC2, disable OIDC group-authenticated login if patching isn't possible, and hunt for unexpected Technician account creation, sessions, and script executions from unfamiliar IPs. Federal civilian agencies were required to remediate by July 2 under CISA's KEV mandate.
