Forged OIDC tokens in SimpleHelp RMM handed out technician access to 1,000 exposed servers, no MFA required

Horizon3.ai disclosed CVE-2026-48558 on June 12, 2026, a critical authentication bypass in SimpleHelp remote monitoring and management software rooted in improper verification of OpenID Connect token signatures. Where group-authenticated login is configured, an attacker can forge an OIDC token without holding any legitimate credential and receive privileged technician-level access to the server, sidestepping MFA entirely since there's no real login to challenge. Arctic Wolf reports active exploitation in the wild, with attackers deploying custom malware specifically to harvest credentials and establish persistent access across every environment a compromised SimpleHelp instance manages. Roughly 14,000 SimpleHelp servers sit exposed to the internet, an estimated 1,000 of them directly vulnerable. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 29 with a July 2 remediation deadline; fixed versions are 5.5.16 and the 6.0 release candidate onward.

Why it matters

An RMM platform's authentication is a multiplier: compromise the login and you don't get one victim, you get privileged access into every customer environment that RMM instance manages, which is exactly why RMM auth bugs are a favored ransomware initial-access vector. Forging the token rather than stealing a password also means the usual signals, password spray alerts, impossible-travel logins, never fire, because nothing about the token's origin looks wrong to a system that only checks the signature and gets fooled by it.

If SimpleHelp with OIDC and group login is anywhere in your stack, confirm the version specifically rather than trusting that "we patched RMM at some point," and audit for the custom credential-harvesting malware Arctic Wolf documented, since exploitation predates the patch by weeks.

Source: Arctic Wolf