--- title: "SimpleHelp CVE-2024-57726/57728: Ransomware Chain in KEV" url: https://erroneo.us/security/briefs/simplehelp-cve-2024-57726-57728-privesc-file-upload-kev/ description: "Technician-to-admin escalation and zip-slip upload in SimpleHelp 5.5.7 and earlier, used in ransomware attacks on MSPs. Fixed in 5.5.8. Check servers." type: security-brief section: "Security Digest" date_published: 2025-01-08 date_modified: 2026-10-23 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2024-57726", "CVE-2024-57728"] severity: "critical" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # SimpleHelp CVE-2024-57726/57728: Ransomware Chain in KEV **Verdict: Check exposure.** Patched SimpleHelp servers are fine, but any server still on 5.5.7 or older, including copies run by an MSP or bundled in a vendor's product, should be upgraded now and investigated, because ransomware crews have used this chain to reach every connected machine. - **Who must act:** Anyone who runs a SimpleHelp server below 5.5.8 (or an unpatched 5.4.10 or 5.3.9), and any organization whose endpoints run a SimpleHelp Remote Access service registered to a third party's server. - **Who can relax:** Servers already on 5.5.16 or later that are reachable only from approved addresses, use directory-backed technician logins and show no unexplained logins or API tokens. - **Affected:** SimpleHelp 5.5.7 and all earlier releases; SimpleHelp 5.4.10 and 5.3.9 without Patch 070125 - **Fixed:** SimpleHelp 5.5.8 and later; SimpleHelp 5.4.10 and 5.3.9 with Patch 070125; Recommended now: 5.5.16 (May 2026), which also fixes a separate 2026 flaw - **CVEs:** CVE-2024-57726, CVE-2024-57728 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Find every SimpleHelp server, including ones run by MSPs or embedded in vendor products, and check its version. 2. Upgrade to 5.5.16 or later; 5.5.8 is the floor for these CVEs, and the 5.4/5.3 patches do not cover the 2026 flaw. 3. Change the SimpleHelpAdmin and local technician passwords, disable SimpleHelpAdmin, and move technicians to LDAP or Active Directory logins. 4. Recreate API tokens and restrict technician, admin and API logins to approved IP addresses. 5. On endpoints, check serviceconfig.xml for unknown server addresses and isolate any machine that has them. ### How to check if you are affected - Review server logs for technician logins from unexpected IPs ('[Authentication] Valid tech connection attempt' lines) and for API tokens nobody created. - Treat '[WebDownloadServer] Insecure request' log entries (5.5.8 and later) as someone probing for the file-read bug. - Look for files written outside the SimpleHelp folder, such as new crontab entries on Linux or replaced executables and libraries on Windows. - Search endpoints for three-letter executables (aaa.exe, bbb.exe) created after January 2025, which CISA lists as an indicator. ## What happened SimpleHelp is a remote support and access tool. Its server brokers technician connections to customer machines, and many managed service providers (MSPs) run it. On January 6, 2025, Horizon3.ai reported three flaws to SimpleHelp. The vendor shipped 5.5.8 and a 5.4.10 patch on January 8 and a 5.3.9 patch on January 13. [Horizon3's disclosure](https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/) describes them: - [CVE-2024-57726](https://www.cve.org/CVERecord?id=CVE-2024-57726) ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-57726) 9.9): admin functions lack backend authorization checks. A low-privilege technician can create over-privileged API keys and promote themselves to server admin. - [CVE-2024-57728](https://www.cve.org/CVERecord?id=CVE-2024-57728) ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-57728) 7.2): an admin can upload a crafted zip that writes files anywhere on the host ("zip slip"). That means a crontab entry on Linux or a replaced executable or library on Windows, giving code execution. - CVE-2024-57727, an unauthenticated file read that exposes `serverconfig.xml` and its password hashes. CISA added it to KEV in February 2025, and it is covered separately. Together they form a full chain: read the config, crack or reuse a technician password, become admin, then upload code. [Sophos](https://www.sophos.com/en-us/blog/dragonforce-actors-target-simplehelp-vulnerabilities-to-attack-msp-customers) reported in May 2025, with "medium confidence", that a DragonForce ransomware operator chained all three against an MSP's SimpleHelp server. The operator used it to survey the MSP's customers, steal data and deploy ransomware. CISA's June 2025 advisory [AA25-163A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a) described ransomware actors reaching a utility billing software provider's customers through unpatched SimpleHelp, but named only CVE-2024-57727. CISA added CVE-2024-57726 and CVE-2024-57728 to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57726) on April 24, 2026, with ransomware use marked "Known". CISA has not said what exploitation prompted the April 2026 listing. ## Who is affected SimpleHelp 5.5.7 and all earlier releases, per the [vendor's notice](https://simple-help.com/kb---security-vulnerabilities-01-2025). 5.4.10 and 5.3.9 are fixed only with Patch 070125. AA25-163A notes that SimpleHelp can be embedded in vendor software or run by a provider on your network, so you may not know it is there. ## Do you really need to act? Most current servers are fine. The risk is an unpatched server, because it controls every machine that registers with it. SimpleHelp has also fixed a newer bug since then (CVE-2026-48558): its [May 2026 update](https://simple-help.com/security/simplehelp-security-update-2026-05) ships 5.5.16 and offers no 5.4 or 5.3 fix. Anything older than 5.5.16 still needs attention. ## What to do now 1. Check each server's version: `curl -s https://support.example.com/allversions`, or `curl -sI https://support.example.com/ | grep -i '^server'`. You can also read the top of `SimpleHelp/configuration/serverconfig.xml`. 2. Upgrade to 5.5.16 or later. 3. Follow the vendor's hardening steps. Change the SimpleHelpAdmin and local technician passwords, disable SimpleHelpAdmin, use LDAP or Active Directory for technicians, recreate API tokens, and restrict login and API source IPs. 4. On endpoints, open `JWrapper-Remote Access/JWAppsSharedConfig/serviceconfig.xml` (Windows: `%APPDATA%`; Linux: `/opt`; macOS: `/Library/Application Support`) and confirm every `