U.S. CISA adds SimpleHelp flaw to its Known Exploited Vulnerabilities catalog

CISA added CVE-2026-48558, a critical (CVSS 10.0) SimpleHelp OIDC authentication-bypass flaw, to its Known Exploited Vulnerabilities catalog after researchers and responders observed active exploitation that can grant unauthenticated attackers technician-level access (sometimes bypassing MFA). The issue affects widely exposed SimpleHelp servers, has associated malware (TaskWeaver, Djinn Stealer), published IoCs, and carries high risk of lateral movement, data theft, and privileged compromise — agencies were ordered to remediate by July 2, 2026.