Critical SimpleHelp bug exposes remote support servers

SimpleHelp, a remote support and management tool used by enterprises, has patched a critical vulnerability that could allow attackers to create rogue administrator accounts on exposed servers. The flaw, tracked as CVE-2026-48558, affects servers configured with OpenID Connect (OIDC) authentication and could enable full control over managed endpoints without requiring multi-factor authentication (MFA).

What happened

Researchers at Horizon3.ai discovered that SimpleHelp versions 5.5.15 and earlier, as well as pre-release 6.0 versions, improperly validate identity assertions from OIDC identity providers. When OIDC authentication is enabled, an unauthenticated attacker can exploit this weakness to create and log in as a new "Technician" user with default administrative privileges. These privileges include remote access to managed devices, script execution, and other high-risk management activities.

The vulnerability does not affect all SimpleHelp servers running vulnerable versions. Exploitation requires three specific conditions: OIDC authentication must be enabled, at least one Technician Group must be associated with the OIDC provider, and the group must have "Allow group authenticated logins" enabled. Horizon3.ai estimates that roughly 7.2% of the approximately 14,000 publicly exposed SimpleHelp servers meet these criteria, suggesting around 1,000 vulnerable instances.

SimpleHelp released patches on June 9 with versions 5.5.16 and 6.0RC2. The company has not reported evidence of active exploitation, but Horizon3.ai notes that SimpleHelp has historically attracted significant threat actor interest. Organizations unable to patch immediately can mitigate the risk by restricting technician logins to trusted IP addresses via allowlists.

How to detect and respond

Horizon3.ai provided indicators of compromise to help organizations detect potential exploitation. Security teams should check for:

• Newly created Technician accounts with unfamiliar names or email addresses
• Log entries in /opt/SimpleHelp/logs/server.log or /opt/SimpleHelp/logs/<YYYYMMDD-HHMMSS>/server.log showing unexpected technician registrations, email addresses, or configuration changes

Why this matters

Remote support tools like SimpleHelp are high-value targets for attackers due to their privileged access to enterprise endpoints. The ability to create rogue administrator accounts without MFA bypasses a critical security control, potentially granting attackers persistent access to managed systems. While the vulnerability is limited to servers with specific OIDC configurations, the widespread exposure of SimpleHelp servers—particularly in large enterprises—amplifies the risk.

Horizon3.ai’s analysis underscores the importance of validating third-party authentication integrations, even in niche enterprise software. The flaw highlights how misconfigurations in identity provider settings can undermine security controls, particularly when default group permissions are overly permissive. Organizations using SimpleHelp should treat this vulnerability as a priority, given the tool’s history of attracting malicious interest and the potential for lateral movement within networks.