Actively exploited vulnerabilities affecting SimpleHelp products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2026-48558https://wildfortech.com/security#CVE-2026-48558SimpleHelp's OIDC authentication flow fails to verify the cryptographic signatures of identity tokens at login. This means an unauthenticated attacker can craft a forged token with any identity claims they choose and receive a fully authenticated technician session in return. In some configurations, this also bypasses multi-factor authentication entirely. Since SimpleHelp is remote support software, a successful exploit gives attackers technician-level access to managed endpoints — a serious risk for any organization using OIDC-based login.Mon, 29 Jun 2026 00:00:00 GMTSimpleHelp SimpleHelphttps://wildfortech.com/security#CVE-2024-57726https://wildfortech.com/security#CVE-2024-57726This flaw in SimpleHelp allows low-privileged technicians to generate API keys that carry far more permissions than their account should allow. By exploiting these over-privileged keys, an attacker can escalate all the way to full server administrator access. The vulnerability has already been linked to ransomware activity, meaning real-world attackers are actively leveraging it — making exposure through any internet-facing SimpleHelp deployment particularly dangerous.Fri, 24 Apr 2026 00:00:00 GMTSimpleHelp SimpleHelphttps://wildfortech.com/security#CVE-2024-57728https://wildfortech.com/security#CVE-2024-57728SimpleHelp, a remote support tool, contains a path traversal flaw where admin-level users can upload a specially crafted zip file that places files anywhere on the server's filesystem — a classic 'zip slip' attack. This allows attackers to achieve arbitrary code execution running as the SimpleHelp server process. The vulnerability is already linked to active ransomware campaigns, making unpatched installations a high-priority target for significant business disruption.Fri, 24 Apr 2026 00:00:00 GMTSimpleHelp SimpleHelp