Back to Blog

Your IT Provider’s Remote Access Tool Has a Critical Flaw. Ask Them If They’ve Patched It.

The whole premise of managed IT is trust. You hire a provider, they put remote management software on your computers, and they use it to fix things without driving over every time. That’s the deal. It’s convenient. It saves money. And it works, as long as the software itself isn’t the problem.

Last week, it was.

CVE-2026-48558 is a critical authentication bypass in SimpleHelp, one of the more common remote monitoring and management (RMM) platforms that IT providers use to access client machines.[1] CISA rated it a 10.0 on the CVSS scale. That’s the maximum severity score, and it doesn’t get handed out often. The flaw has been actively exploited since at least late June. CISA added it to the Known Exploited Vulnerabilities catalog on June 29th with a federal remediation deadline of July 2nd.[2] That deadline has already passed.

What the Flaw Actually Does

SimpleHelp supports a login method called OIDC (OpenID Connect). When it’s configured, the software is supposed to verify that authentication tokens are legitimate before granting access. The problem: it doesn’t.[3] An attacker can forge a token, claim to be an authorized technician, and get full access to the SimpleHelp server without a real password, without MFA, without anything.

From there, they have administrative access to every endpoint that server manages. Every computer, every client.

Researchers scanning the internet found approximately 14,000 SimpleHelp servers publicly exposed, with roughly 1,000 of them directly vulnerable.[1] That’s 1,000 IT providers or internal IT departments, each managing anywhere from a dozen to hundreds of client environments. And some of those providers serve small businesses just like yours.

Why MSP Attacks Are a Different Category of Problem

Most cyberattacks target one organization at a time. Break into a company’s network, steal their data, move on. That’s bad, but it’s contained.

Attacks through managed service provider tools are different. One compromised SimpleHelp server doesn’t give attackers one victim. It gives them every client the MSP manages. You don’t need to be targeted individually. You just need to be a customer of someone who got hit.

The Verizon 2026 Data Breach Investigations Report put some numbers to this. Of confirmed breaches involving small and medium businesses, third parties were involved in 55 percent of them.[4] This is the mechanism. Your vendor, your IT provider, your software supplier - they become the entry point.

In this case, attackers exploiting CVE-2026-48558 were deploying two distinct payloads on compromised endpoints. TaskWeaver Loader establishes persistent access, meaning it survives reboots and removal attempts.[3] Djinn Stealer is a credential harvester - it pulls saved passwords, session tokens, and authentication cookies from browsers and installed applications.[1] The combination is designed for quiet, ongoing access rather than a smash-and-grab. They get in, stay in, and siphon data over time.

What You Should Actually Ask Your IT Provider

The fix exists. SimpleHelp 5.5.16 and the 6.0 release candidate both patch this vulnerability. If your provider has upgraded, you’re fine. The question is whether they have.

Start simple: ask which remote management tools they use. If SimpleHelp is in the answer, follow up with: “Have you upgraded to version 5.5.16 or later?” That’s a yes-or-no question. A provider who’s on top of their security posture will know the answer immediately, probably before you finish asking.

If they don’t know, or give you something vague, that’s worth paying attention to. CISA put this on their KEV list on June 29th. Any managed IT team worth their monthly retainer was aware of it within 24 hours and had patched within 48. It shouldn’t be a mystery.

There are a few other reasonable things to check on your end regardless of the answer. Look at Windows Event Viewer for remote session logs at unexpected hours, especially connections from unfamiliar locations. It’s not a complete security audit, but unusual activity at 3am is unusual activity at 3am. Also worth asking your provider for their written patch management policy: how quickly do they apply critical patches, and what’s their process for notifying clients when something like this surfaces?

I’ve seen small business owners assume their IT provider handles all of this automatically. Sometimes they do. But “assume” is not a security posture. Asking the question costs nothing. Not asking it when a CVSS 10.0 vulnerability is being actively exploited is a different kind of cost.