Stealers Exploit CVE-2026-48558 in SimpleHelp Attack

Threat Intel
, , , ,
1

Last Updated: 2026-06-30T19:15:57Z

Star Trek TNG episode title card with title of this post
Star Trek TNG episode title card with title of this post1440×1080 211 KB

What’s Happening

Blackpoint Cyber has identified two separated malware samples exploiting CVE-2026-48558 (CVSS 10), an auth bypass in the SimpleHelp remote access tool.

Affected versions are SimpleHelp 5.5.15 and prior and 6.0 pre-release.

The CVE has been added to CISA’s Known Exploited Vulnerabilities list.

Actions

Running a SimpleHelp server? Patch immediately. Version 6.0 (release) and 5.5.16 are patched.

Review Blackpoint’s advisory for indicators of compromise. The filenames are generic enough to require specific review.

Notes

Shodan shows 12k+ SimpleHelp servers online. Of those, only 224 have a “2025” version slug in the Server header, so most visible SimpleHelp servers could be exposed.

I’ve attached a list of SimpleHelp servers from Shodan to help assess risk/exposure.

simplehelp_servers.txt (168.3 KB)

1 Like
2

I wrote a version and function-based Nuclei vulnerability template for this a couple of weeks back: nuclei-templates/cve/CVE-2026-48558.yaml at main · darses/nuclei-templates · GitHub. I expect it to work quite reliably, although I do not remember why I did not set it to verified: true. Especially the OIDC requirement is not always present, which will lead to inflated numbers if you just look at the usage of SimpleHelp in general.

1 Like
3

Alas, running that scanner against the Shodan list would probably cross a line. But I’m glad a better verification exists!