SimpleHelp <= 5.5.7 - Privilege Escalation

Exploited in the wild. Listed by CISA on 2026-04-24; known to be used by ransomware.

criticalseverity

9.9CVSS score

66.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

SimpleHelp remote support software v5.5.7 and before contains a privilege escalation caused by insufficient access controls in API key creation, letting low-privileges technicians escalate privileges to server admin, exploit requires low-privileges technician access.

Impact

Attackers can escalate privileges to server admin, potentially gaining full control over the system.

Fix

Update to the latest version of SimpleHelp that addresses this issue or apply the vendor's security patch.

How to confirm it

Send: GET {{BaseURL}}/allversions
Positive when: status 200 AND contains "SH Version:" and "Visual Version:" AND compare_versions(version, "< 5.5.8")

Run it with nuclei: nuclei -id CVE-2024-57726 -u <target>

The full check

id: CVE-2024-57726

info:
  name: SimpleHelp <= 5.5.7 - Privilege Escalation
  author: popy21
  severity: critical
  description: |
    SimpleHelp remote support software v5.5.7 and before contains a privilege escalation caused by insufficient access controls in API key creation, letting low-privileges technicians escalate privileges to server admin, exploit requires low-privileges technician access.
  impact: |
    Attackers can escalate privileges to server admin, potentially gaining full control over the system.
  remediation: |
    Update to the latest version of SimpleHelp that addresses this issue or apply the vendor's security patch.
  reference:
    - https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier
    - https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57726
    - https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/
    - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-dragonforce
    - https://nvd.nist.gov/vuln/detail/CVE-2024-57726
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2024-57726
    cwe-id: CWE-862
    epss-score: 0.66414
    epss-percentile: 0.99289
    cpe: cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: simple-help
    product: simplehelp
    shodan-query: html:"SimpleHelp"
  tags: cve,cve2024,simple-help,simplehelp,auth-bypass,kev,passive,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/allversions"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "SH Version:"
          - "Visual Version:"
        condition: and

      - type: dsl
        dsl:
          - 'compare_versions(version, "< 5.5.8")'

    extractors:
      - type: regex
        part: body
        name: version
        internal: true
        regex:
          - 'Visual Version:\s*(?:[0-4]\.[0-9]+(?:\.[0-9]+)?|5\.[0-2](?:\.[0-9]+)?|5\.3\.[0-8]|5\.4\.[0-9]|5\.5\.[0-7])\b'

References

Use this check only on systems you are authorised to test. Where the data comes from