# CISA adds SimpleHelp auth bypass to KEV

Published: 2026-06-29 · Severity: high · Sectors: government-national
Canonical: https://vorant.io/reports/5887e99e-a125-516e-a50f-e2fde9e44cb4/cisa-adds-simplehelp-auth-bypass-to-kev

> CISA added CVE-2026-48558, a SimpleHelp authentication bypass vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.

CISA has updated its Known Exploited Vulnerabilities Catalog to include CVE-2026-48558, an authentication bypass vulnerability in SimpleHelp that is being actively exploited in the wild. The addition is based on confirmed evidence of exploitation activity targeting this flaw.

The vulnerability represents a frequent attack vector used by malicious cyber actors and poses significant risks, particularly to federal networks. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies are required to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets, especially those that grant total control of the system post-exploitation.

While BOD 26-04 applies specifically to federal agencies, CISA recommends that all organizations adopt risk-based vulnerability management practices and prioritize patching vulnerabilities listed in the KEV Catalog. Organizations using SimpleHelp should apply available mitigations immediately and assess whether systems were compromised prior to patching.

## Mentioned in this report

- Vulnerabilities: CVE-2026-48558 (KEV)

## Detection guidance (public sample)

### Suspicious Child Process Spawned by SimpleHelp Remote Access Service

ATT&CK: T1078

Detects command shells or scripting engines spawned from the SimpleHelp remote support service process, which may indicate post-authentication-bypass abuse of a valid/compromised SimpleHelp session to gain interactive control of the host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by SimpleHelp Remote Access Service
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \SimpleHelp.exe
    - \JWrapper-Remote Access.exe
    - \RemoteAccess.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
  condition: selection_parent and selection_child
  falsepositives:
  - Legitimate help-desk technicians using SimpleHelp to run scripts or open a command
    prompt for authorized remote support
  - Scheduled maintenance scripts triggered through the SimpleHelp agent
  level: medium
  fields:
  - ParentImage
  - Image
  - CommandLine
  - User
  tags:
  - attack.t1078
id: 889f3578-67a2-587d-9f89-072868260e52
status: experimental
author: Vorant
```

### SimpleHelp Service Process Started from Unexpected Working Directory

ATT&CK: T1078

Detects the SimpleHelp remote access service binary being launched from a non-standard installation path, which can indicate an attacker-dropped or renamed copy of the tool used to maintain unauthorized access after exploiting the authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SimpleHelp Binary Executed From Non-Standard Path
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith:
    - \SimpleHelp.exe
    - \JWrapper-Remote Access.exe
    - \RemoteAccess.exe
  filter_standard_path:
    Image|contains:
    - :\\Program Files\\SimpleHelp\\
    - :\\Program Files (x86)\\SimpleHelp\\
  condition: selection_name and not filter_standard_path
  falsepositives:
  - Portable or manually relocated legitimate SimpleHelp installations used by IT
    staff
  - Testing or staging deployments of SimpleHelp outside the default install directory
  level: medium
  fields:
  - Image
  - ParentImage
  - CommandLine
  tags:
  - attack.t1078
id: ac978736-6171-5539-8939-133ba13d2246
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/29/cisa-adds-one-known-exploited-vulnerability-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5887e99e-a125-516e-a50f-e2fde9e44cb4/cisa-adds-simplehelp-auth-bypass-to-kev.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup