CVE-2024-57726: SimpleHelp privilege escalation via missing authorization in API key creation

CVE-2024-57726 · Severity: critical · CVSS 9.9 · Exploited in the wild · Published 2026-04-24

SimpleHelp, a remote support and management platform, contains a security flaw that allows technicians with limited access to grant themselves full administrative control. By creating unauthorized API keys with elevated permissions, a low-privileged user can take over the entire server. This vulnerability has been actively exploited in the wild, potentially leading to full system compromise and deployment of ransomware.

Technologies: SimpleHelp. Vendors: Simplehelp.

Quick answers

Is CVE-2024-57726 exploited in the wild?
Yes. CVE-2024-57726 is known to be exploited in the wild, first recorded on 24 April 2026. Treat it as urgent.
How severe is CVE-2024-57726?
Critical severity, with a CVSS score of 9.9, published 24 April 2026.
Which products and versions are affected?
Simplehelp Remote Support Software v5.5.7 and earlier.
Is there a fix for CVE-2024-57726?
A patch was published on 2025-01-16: Vendor release notes for version 5.5.8+ address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-57726 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-57726?
Check whether you run Simplehelp Remote Support Software or SimpleHelp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in SimpleHelp remote support software versions 5.5.7 and prior. The flaw allows an authenticated user with 'technician' level privileges to bypass intended access controls and generate API keys with permissions exceeding their own. These keys can then be leveraged to escalate privileges to the 'server admin' role. The attack is network-reachable and requires low complexity, though it does require valid technician credentials. This vulnerability is documented as being exploited in the wild by threat actors for ransomware operations. Users should update to version 5.5.8 or later to remediate the issue.

Affected products

  • SimpleHelp SimpleHelp Remote Support Software v5.5.7 and earlier

Timeline

  • 2025-01-15: disclosed: Initial CVE publication
  • 2025-01-16: patched: Vendor release notes for version 5.5.8+ address the issue
  • 2026-04-24: kev added: CISA added to Known Exploited Vulnerabilities catalog
  • 2026-04-24: exploited: Reports of use in Medusa ransomware operations

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.