CISA Warns of Multiple SimpleHelp Vulnerabilities Exploited in Attack

**CISA alert: two critical SimpleHelp vulnerabilities (CVE-2024-57726 and CVE-2024-57728) are actively exploited; one allows privilege escalation via missing authorization and the other enables path traversal/zip-slip uploads leading to arbitrary code execution. CISA added them to the KEV catalog and set a remediation deadline of May 8, 2026; organizations should apply vendor updates, monitor for suspicious API key creation and file uploads, and disconnect or discontinue use if mitigations are unavailable.**