CISA adds SimpleHelp auth bypass to KEV

29 June 2026 high vulnerability government-national

CISA added CVE-2026-48558, a SimpleHelp authentication bypass vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.

CISA has updated its Known Exploited Vulnerabilities Catalog to include CVE-2026-48558, an authentication bypass vulnerability in SimpleHelp that is being actively exploited in the wild. The addition is based on confirmed evidence of exploitation activity targeting this flaw.

The vulnerability represents a frequent attack vector used by malicious cyber actors and poses significant risks, particularly to federal networks. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies are required to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets, especially those that grant total control of the system post-exploitation.

While BOD 26-04 applies specifically to federal agencies, CISA recommends that all organizations adopt risk-based vulnerability management practices and prioritize patching vulnerabilities listed in the KEV Catalog. Organizations using SimpleHelp should apply available mitigations immediately and assess whether systems were compromised prior to patching.

Mentioned in this report

Vulnerabilities CVE-2026-48558KEV

Detection guidance

Suspicious Child Process Spawned by SimpleHelp Remote Access Service

ATT&CK T1078

Detects command shells or scripting engines spawned from the SimpleHelp remote support service process, which may indicate post-authentication-bypass abuse of a valid/compromised SimpleHelp session to gain interactive control of the host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned by SimpleHelp Remote Access Service
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \SimpleHelp.exe
    - \JWrapper-Remote Access.exe
    - \RemoteAccess.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
  condition: selection_parent and selection_child
  falsepositives:
  - Legitimate help-desk technicians using SimpleHelp to run scripts or open a command
    prompt for authorized remote support
  - Scheduled maintenance scripts triggered through the SimpleHelp agent
  level: medium
  fields:
  - ParentImage
  - Image
  - CommandLine
  - User
  tags:
  - attack.t1078
id: 889f3578-67a2-587d-9f89-072868260e52
status: experimental
author: Vorant

SimpleHelp Service Process Started from Unexpected Working Directory

ATT&CK T1078

Detects the SimpleHelp remote access service binary being launched from a non-standard installation path, which can indicate an attacker-dropped or renamed copy of the tool used to maintain unauthorized access after exploiting the authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: SimpleHelp Binary Executed From Non-Standard Path
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith:
    - \SimpleHelp.exe
    - \JWrapper-Remote Access.exe
    - \RemoteAccess.exe
  filter_standard_path:
    Image|contains:
    - :\\Program Files\\SimpleHelp\\
    - :\\Program Files (x86)\\SimpleHelp\\
  condition: selection_name and not filter_standard_path
  falsepositives:
  - Portable or manually relocated legitimate SimpleHelp installations used by IT
    staff
  - Testing or staging deployments of SimpleHelp outside the default install directory
  level: medium
  fields:
  - Image
  - ParentImage
  - CommandLine
  tags:
  - attack.t1078
id: ac978736-6171-5539-8939-133ba13d2246
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/29/cisa-adds-one-known-exploited-vulnerability-catalog

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free