CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Called exploited 17 days after disclosure.
Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing17d
- Last sighting37d
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federallisted Jun 29, 2026
- EUVDENISA, European Unionlisted Jun 29, 2026
- VulnCheck KEVcommercial researchlisted Jun 29, 2026
- CIRCLaggregator, mirrors the abovelisted Jun 29, 2026, not counted
3 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationblackpointcyber.com/blog/notes-from-the-chief-security-and-t
- reported exploitationcyble.com/reports/H1-2026-Global-Threat-Landscape-Report.pdf
- reported exploitationwww.recordedfuture.com/blog/june-2026-cve-landscape
- reported exploitationblackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-
- reported exploitationprevidian.com/CVE-2026-48558
- reported exploitationwww.cisa.gov/sites/default/files/feeds/known_exploited_vulne
6 public reports collected from VulnCheck and CIRCL, first on Jun 29, 2026. Each links to its original source. We have not verified them.
Description
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
