# SimpleHelp technicians can promote themselves to server admin

Source: https://startwithidentity.com/cves/cve-2024-57726/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

SimpleHelp is self-hosted remote support software. Technicians sign in to a server and from there reach every machine with a SimpleHelp client installed. Horizon3.ai disclosed on January 13, 2025 that some admin functions in SimpleHelp 5.5.7 and earlier were "missing backend authorization checks" (CWE-862). NVD describes the result: a low-privilege technician can create [API keys](https://startwithidentity.com/glossary/api-key/) with more permissions than the technician holds, and use them to reach the server admin role. NVD and Horizon3 both score it CVSS 3.1 9.9. Scope is "changed" because an admin can reach client machines the technician could not.

Horizon3 chained it with CVE-2024-57728, an authenticated file upload: once a technician is an admin, a crontab file on Linux or a replaced binary on Windows gives code execution on the server. SimpleHelp fixed both in 5.5.8 and 5.4.10 on January 8, 2025 and in 5.3.9 on January 13, 2025.

CISA added it to KEV on April 24, 2026 and marks it as used in ransomware campaigns. Microsoft's April 2026 report on Storm-1175, the group that deploys Medusa ransomware, lists CVE-2024-57726, CVE-2024-57727 and CVE-2024-57728 among the vulnerabilities it has exploited.

## Why it matters

The technician role is the access control in a remote support tool. Each technician is meant to see only their own customer groups. When the server does not check roles on its own admin functions, one technician account becomes admin over every managed endpoint. This is [privilege escalation](https://startwithidentity.com/glossary/privilege-escalation/) on a platform that already holds [standing privilege](https://startwithidentity.com/glossary/standing-privilege/) over many networks.

## What to do

- Upgrade to SimpleHelp 5.5.8 or later, or apply the 5.4.10 or 5.3.9 patch.
- Change the administrator password. SimpleHelp suggests disabling the built-in SimpleHelpAdmin user and using a separate admin technician account.
- Change technician passwords, or move technician login to Active Directory or LDAP.
- Restrict the IP addresses allowed for technician and admin logins and for API requests.

## After you patch

- Create new API tokens and delete the old ones, because a token minted through this flaw keeps its rights after the upgrade.
- Set Server Event alerts for admin logins, failed logins and configuration changes, and check Remote Access services for server URLs you do not recognize.
- Review managed endpoints for new local admins, renamed Cloudflare tunnels and other RMM tools, all of which Microsoft lists in Storm-1175 intrusions.

## Sources

- [NVD: CVE-2024-57726](https://nvd.nist.gov/vuln/detail/cve-2024-57726)
- [SimpleHelp: Security vulnerabilities 01-2025](https://guides.simple-help.com/kb---security-vulnerabilities-01-2025)
- [Horizon3.ai: Critical vulnerabilities in SimpleHelp remote support software (January 13, 2025)](https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/)
- [Microsoft Threat Intelligence: Storm-1175 and Medusa ransomware (April 6, 2026)](https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/)
- [CISA Known Exploited Vulnerabilities catalog, added April 24, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57726)