CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2024-57726: SimpleHelp Missing Authorization Vulnerability

criticalknown exploitedCVE-2024-57726
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

CSIRTS triage

vendor: SimpleHelpproduct: SimpleHelpAuthentication bypassPrivilege escalation
What
The vulnerability allows low-privileged technicians to create API keys with excessive permissions, leading to privilege escalation.
Who is affected
Users of SimpleHelp are affected.
Urgency
Remediation is urgent due to the critical nature of the vulnerability and its exploitation status.
Action
Update to the patched version as soon as it is available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch SimpleHelp

Get an email when a new SimpleHelp advisory drops — max one per day, one-click unsubscribe.

Details

Source
CISA Known Exploited Vulnerabilities (US · database · site)
Severity
critical
Published
2026-04-24
Exploitation
Observed in the wild (CISA KEV)

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-57726

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2024-57726coverage & exploitation statusNVD · CVE.org

More from CISA Known Exploited Vulnerabilities