ZeroDay Findings
Sign inSign up

Findings

CVE-2024-57726

SimpleHelp Missing Authorization Vulnerability

Published Jan 15, 2025 · updated Jun 17, 2026 · SimpleHelp SimpleHelp

SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 15, 2025 · Catalog

    Detected

    SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

  2. Apr 24, 2026 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. May 8, 2026 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date May 8, 2026

Affected

  • cpe simple-help/simplehelpversion unspecified
  • vendor SimpleHelp SimpleHelpversion unspecified

Sources

  • CISA KEVCVE-2024-57726

    SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

    cisa.gov
  • CVE.orgCVE-2024-57726

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-57726

    30-day exploitation probability 66.6%

    first.org
  • NIST NVDCVE-2024-57726

    SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

    nvd.nist.gov

References