Summary

A critical vulnerability has been disclosed in the SimpleHelp remote support platform that allows unauthenticated attackers to create rogue administrator accounts. This flaw enables complete takeover of the SimpleHelp server and all connected client machines.

Affected Product

• SimpleHelp – Remote support and remote access platform (all versions prior to the patched release)

Vulnerability Details

The vulnerability resides in the administrator account creation mechanism. Due to insufficient access controls, an unauthenticated remote attacker can send specially crafted requests to the SimpleHelp server to create a new administrator account with full privileges. Once an attacker gains administrative access, they can:

• Access all active remote support sessions
• Connect to any managed client machine
• Exfiltrate sensitive data from connected endpoints
• Deploy malware or ransomware across the managed fleet
• Modify server configurations and disable security controls

Why This Matters

Remote support platforms like SimpleHelp are high-value targets for threat actors. These tools are designed to provide privileged access to endpoints across an organization, often bypassing firewall restrictions and endpoint security controls. Compromising a remote support platform effectively hands attackers the keys to every managed device. This is particularly dangerous for Managed Service Providers (MSPs) who use SimpleHelp to support multiple client organizations — a single breach could cascade across dozens or hundreds of downstream customers.

Remediation

1. Apply the Patch: SimpleHelp has released a security update addressing this vulnerability. Upgrade to the latest version immediately.
2. Audit Administrator Accounts: Review all administrator accounts on your SimpleHelp server for any unrecognized or unauthorized entries. Remove any suspicious accounts immediately.
3. Restrict Admin Interface Access: Where possible, restrict access to the SimpleHelp administrative interface to trusted IP addresses using network-level access controls (firewall rules, VPN-only access, or IP allowlisting).
4. Review Access Logs: Examine server access logs for signs of unauthorized administrative activity, particularly around the time of account creation events.
5. Enable Multi-Factor Authentication: If supported by your version, enable MFA for all administrator accounts.

References

• BleepingComputer – Original disclosure and analysis

Timeline

• June 2026: Vulnerability publicly disclosed