CVE-2024-57726
SimpleHelp Missing Authorization Vulnerability
Published Jan 15, 2025 · updated Jun 17, 2026 · SimpleHelp SimpleHelp
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jan 15, 2025 · Catalog
Detected
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
Apr 24, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
May 8, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date May 8, 2026
Affected
- cpe simple-help/simplehelpversion unspecified
- vendor SimpleHelp SimpleHelpversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2024-57726
SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
cisa.gov - CVE.orgVulnerability recordCVE-2024-57726
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2024-57726
30-day exploitation probability 66.6%
first.org - NIST NVDVulnerability recordCVE-2024-57726
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
nvd.nist.gov