Security Digest · Jan 8, 2025 · Vulnerability · Other
SimpleHelp CVE-2024-57726/57728: Ransomware Chain in KEV
Technician-to-admin escalation and zip-slip upload in SimpleHelp 5.5.7 and earlier, used in ransomware attacks on MSPs. Fixed in 5.5.8. Check servers.
Our verdict
Check exposure
Patched SimpleHelp servers are fine, but any server still on 5.5.7 or older, including copies run by an MSP or bundled in a vendor's product, should be upgraded now and investigated, because ransomware crews have used this chain to reach every connected machine.
Who must act: Anyone who runs a SimpleHelp server below 5.5.8 (or an unpatched 5.4.10 or 5.3.9), and any organization whose endpoints run a SimpleHelp Remote Access service registered to a third party's server.
Who can relax: Servers already on 5.5.16 or later that are reachable only from approved addresses, use directory-backed technician logins and show no unexplained logins or API tokens.
- Affected
- SimpleHelp 5.5.7 and all earlier releases
SimpleHelp 5.4.10 and 5.3.9 without Patch 070125 - Fixed in
- SimpleHelp 5.5.8 and later
SimpleHelp 5.4.10 and 5.3.9 with Patch 070125
Recommended now: 5.5.16 (May 2026), which also fixes a separate 2026 flaw - CVSS
- 9.9 (v3.1, NVD)
- EPSS
- 66.4% (percentile 99)
- CISA KEV
- Yes, listed as known exploited
- Exploitation
- Exploited in the wild
- Severity
- Critical
What to do
- Find every SimpleHelp server, including ones run by MSPs or embedded in vendor products, and check its version.
- Upgrade to 5.5.16 or later; 5.5.8 is the floor for these CVEs, and the 5.4/5.3 patches do not cover the 2026 flaw.
- Change the SimpleHelpAdmin and local technician passwords, disable SimpleHelpAdmin, and move technicians to LDAP or Active Directory logins.
- Recreate API tokens and restrict technician, admin and API logins to approved IP addresses.
- On endpoints, check serviceconfig.xml for unknown server addresses and isolate any machine that has them.
How to check if you are affected or compromised
- Review server logs for technician logins from unexpected IPs ('[Authentication] Valid tech connection attempt' lines) and for API tokens nobody created.
- Treat '[WebDownloadServer] Insecure request' log entries (5.5.8 and later) as someone probing for the file-read bug.
- Look for files written outside the SimpleHelp folder, such as new crontab entries on Linux or replaced executables and libraries on Windows.
- Search endpoints for three-letter executables (aaa.exe, bbb.exe) created after January 2025, which CISA lists as an indicator.
What happened#
SimpleHelp is a remote support and access tool. Its server brokers technician connections to customer machines, and many managed service providers (MSPs) run it. On January 6, 2025, Horizon3.ai reported three flaws to SimpleHelp. The vendor shipped 5.5.8 and a 5.4.10 patch on January 8 and a 5.3.9 patch on January 13. Horizon3's disclosure describes them:
- CVE-2024-57726 (NVD 9.9): admin functions lack backend authorization checks. A low-privilege technician can create over-privileged API keys and promote themselves to server admin.
- CVE-2024-57728 (NVD 7.2): an admin can upload a crafted zip that writes files anywhere on the host ("zip slip"). That means a crontab entry on Linux or a replaced executable or library on Windows, giving code execution.
- CVE-2024-57727, an unauthenticated file read that exposes
serverconfig.xmland its password hashes. CISA added it to KEV in February 2025, and it is covered separately.
Together they form a full chain: read the config, crack or reuse a technician password, become admin, then upload code. Sophos reported in May 2025, with "medium confidence", that a DragonForce ransomware operator chained all three against an MSP's SimpleHelp server. The operator used it to survey the MSP's customers, steal data and deploy ransomware. CISA's June 2025 advisory AA25-163A described ransomware actors reaching a utility billing software provider's customers through unpatched SimpleHelp, but named only CVE-2024-57727. CISA added CVE-2024-57726 and CVE-2024-57728 to the KEV catalog on April 24, 2026, with ransomware use marked "Known". CISA has not said what exploitation prompted the April 2026 listing.
Who is affected#
SimpleHelp 5.5.7 and all earlier releases, per the vendor's notice. 5.4.10 and 5.3.9 are fixed only with Patch 070125. AA25-163A notes that SimpleHelp can be embedded in vendor software or run by a provider on your network, so you may not know it is there.
Do you really need to act?#
Most current servers are fine. The risk is an unpatched server, because it controls every machine that registers with it. SimpleHelp has also fixed a newer bug since then (CVE-2026-48558): its May 2026 update ships 5.5.16 and offers no 5.4 or 5.3 fix. Anything older than 5.5.16 still needs attention.
What to do now#
- Check each server's version:
curl -s https://support.example.com/allversions, orcurl -sI https://support.example.com/ | grep -i '^server'. You can also read the top ofSimpleHelp/configuration/serverconfig.xml. - Upgrade to 5.5.16 or later.
- Follow the vendor's hardening steps. Change the SimpleHelpAdmin and local technician passwords, disable SimpleHelpAdmin, use LDAP or Active Directory for technicians, recreate API tokens, and restrict login and API source IPs.
- On endpoints, open
JWrapper-Remote Access/JWAppsSharedConfig/serviceconfig.xml(Windows:%APPDATA%; Linux:/opt; macOS:/Library/Application Support) and confirm every<ConnectToline points to your server.
How to tell if you were hit#
In the server log, review [Authentication] Valid tech connection attempt lines for unexpected usernames or IPs, and check the History tab for sessions you do not recognize. On 5.5.8 and later, [WebDownloadServer] Insecure request entries mean someone is probing for the file-read bug. Look for unexpected API tokens and for files written outside the SimpleHelp directory. On endpoints, check for three-letter executables such as aaa.exe created after January 2025. If you find any of this, isolate the affected machines, keep the logs and get incident response help.
Timeline#
- — Horizon3 reports the vulnerabilities to SimpleHelp.
- — SimpleHelp releases 5.5.8 and the 5.4.10 patch. The 5.3.9 patch follows on January 13.
- — CVEs are assigned.
- — SecurityWeek covers the DragonForce MSP attack Sophos reported.
- — CISA publishes AA25-163A.
- — CISA adds CVE-2024-57726 and CVE-2024-57728 to KEV, with a May 8 deadline (Security Affairs).
Vulnerability records
- CVE-2024-57726 · KEV 2026-04-24 · SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions.
- CVE-2024-57728 · KEV 2026-04-24 · SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file…
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- SimpleHelp — Security vulnerabilities in SimpleHelp 5.5.7 and earlier simple-help.com
- CVE record — CVE-2024-57726 cve.org
- CVE record — CVE-2024-57728 cve.org
- NVD — CVE-2024-57726 nvd.nist.gov
- NVD — CVE-2024-57728 nvd.nist.gov
- CISA — Known Exploited Vulnerabilities: CVE-2024-57726 cisa.gov
- CISA — Known Exploited Vulnerabilities: CVE-2024-57728 cisa.gov
- SimpleHelp — Security Update 2026-05 simple-help.com
- Horizon3.ai — Critical vulnerabilities in SimpleHelp remote support software horizon3.ai
- Sophos — DragonForce actors target SimpleHelp vulnerabilities to attack MSP, customers sophos.com
- CISA — AA25-163A: Ransomware actors exploit unpatched SimpleHelp RMM cisa.gov