CVE-2024-57726: SimpleHelp Missing Authorization Vulnerability

Critical severity, CVSS 9.9. Actively exploited: in CISA KEV since 2026-04-24. EPSS: 66.6% chance of exploitation in the next 30 days.

SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

Affected products

• SimpleHelp SimpleHelp: before 5.5.8 (fixed in 5.5.8)

Published 2025-01-15. Last modified 2026-06-17.