CVE-2024-57726
SimpleHelp Missing Authorization Vulnerability
Description
CVE-2024-57726 is a CRITICAL severity missing authorization vulnerability in SimpleHelp remote support software (versions 5.5.7 and earlier) with a CVSS 3.1 score of 9.9. The flaw allows low-privileged technician accounts to create API keys with excessive permissions; those API keys can then be used to escalate to the server admin role. Combined with the related path-traversal flaw CVE-2024-57728, this turns a foothold from any technician account into full remote code execution on the SimpleHelp server. CISA added CVE-2024-57726 to the KEV catalog on April 24, 2026, with a remediation deadline of May 8, 2026, after Microsoft and Trend Micro reported the SimpleHelp CVE cluster being abused by the Storm-1175 actor and DragonForce ransomware operators. The EPSS score of 0.460 (98th percentile) reflects ongoing widespread exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| simple-help | simplehelp | < 5.5.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier(Release Notes)
- https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57726(US Government Resource)
- https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/(Technical Description)
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-dragonforce(Third Party Advisory)
Weakness Type
CWE-862: Missing Authorization
Missing Authorization occurs when a product does not perform an authorization check when an actor attempts to access a resource or perform an action. While the product may perform authentication to verify identity, it fails to verify that the authenticated actor is permitted to take the requested action. In SimpleHelp ≤ 5.5.7, the API-key creation endpoint authenticates the caller but does not check the caller's role: a technician — intended to have limited operational access — can request the creation of API keys carrying admin-level scopes that the technician is not authorized to assign. The resulting API key can then be presented on subsequent requests to perform admin-only actions, effectively bypassing the role-based access control entirely.
Learn more: CWE-862 — Missing Authorization
Impact Analysis
CVE-2024-57726 carries a CVSS 3.1 score of 9.9 (CRITICAL) with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Each metric is alarming: network-reachable, low complexity, only low privileges required, no user interaction, and Scope:Changed — the highest-impact CVSS 3.1 configuration short of fully unauthenticated. The Scope:Changed rating is critical because it captures that the vulnerability lets an actor cross a security boundary: a technician account, intended to be tightly constrained, can manufacture credentials that grant admin authority on the SimpleHelp server itself. With High impact on Confidentiality, Integrity, and Availability, an attacker who compromises any technician account — through phishing, credential reuse, or insider misuse — gains full administrative control of the SimpleHelp deployment, including all stored credentials, audit data, and persistent connections to managed remote endpoints. In ransomware operations such as those run by DragonForce and Storm-1175, that admin foothold has been the gateway to cross-customer compromise across managed service provider (MSP) estates.
Exploit Maturity
Active Exploitation: CISA added CVE-2024-57726 to the KEV catalog on April 24, 2026 with a remediation deadline of May 8, 2026. Public Exploits and Detailed Analysis: Horizon3.ai published a deep technical disclosure — see "Critical Vulnerabilities in SimpleHelp Remote Support Software" — and the SimpleHelp vendor advisory is available at simple-help.com. Threat Actor Linkage: Microsoft has documented Storm-1175 abusing vulnerable SimpleHelp instances during high-tempo Medusa ransomware operations (Microsoft Security Blog) and Trend Micro has connected the SimpleHelp CVE cluster to the DragonForce ransomware family. Exploitation Probability: With an EPSS score of 0.460 (98th percentile), the model rates the probability of continued exploitation as near-certain. Chaining Potential: CVE-2024-57726 is the privilege-escalation half of the chain — it is most damaging when combined with CVE-2024-57728 (Zip Slip path traversal), which converts admin authority into remote code execution on the SimpleHelp host. Defenders must patch all three SimpleHelp January-2025 advisories together (CVE-2024-57726, -57727, -57728) to close the full exploitation chain.
Remediation
- Upgrade SimpleHelp to 5.5.8 or later. This is the official fix from SimpleHelp and resolves CVE-2024-57726 along with CVE-2024-57727 and CVE-2024-57728. Upgrade steps and post-upgrade configuration changes are documented in the SimpleHelp security advisory.
- Audit and rotate all SimpleHelp API keys. Because the vulnerability allowed unauthorized creation of admin-scoped API keys, every existing API key on a previously vulnerable server must be considered untrusted. Revoke all keys, then issue new ones only for verified workflows after the upgrade.
- Audit technician and admin accounts. Review the full SimpleHelp user list for unfamiliar accounts, recent role changes, or suspicious admin promotions. Reset technician passwords, enforce MFA where available, and remove unused accounts.
- Hunt for persistence. Inspect the SimpleHelp server for newly created admin accounts, scheduled tasks, or files dropped via the chained CVE-2024-57728 Zip Slip after January 2025. Microsoft and Trend Micro indicators of compromise for Storm-1175 and DragonForce should be applied to network logs covering the server and any managed endpoints.
- Long-term hardening. Apply the CWE-862 mitigation principle — every privileged action must be checked against the caller's authorization context, not just authentication. Restrict the SimpleHelp admin/technician console to internal networks or VPN, and segment the SimpleHelp server from sensitive corporate assets so that a compromise does not yield immediate lateral movement.
Technical Details
CVE-2024-57726 is a CWE-862 missing authorization flaw in the API-key creation endpoint of SimpleHelp ≤ 5.5.7. The endpoint correctly authenticates the calling user (verifying their identity), but it does not verify whether the caller's role is permitted to assign the requested scopes to the new API key. A low-privileged technician account can therefore request the creation of an API key carrying admin-scoped permissions, and the server returns a usable key. Subsequent API requests presenting that key are processed under the elevated scopes, effectively converting the technician account into a server-admin equivalent. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H expresses the seriousness: the action is reachable over the network with low attack complexity, only requires a low-privileged authenticated session, needs no user interaction, and crosses a security boundary (Scope:Changed) to grant High impact on Confidentiality, Integrity, and Availability. In typical exploitation, the attacker first obtains a technician account through phishing, credential reuse, or insider misuse, then uses CVE-2024-57726 to mint an admin-scoped API key, and finally chains CVE-2024-57728 to write a malicious file into a server-executable path — yielding remote code execution as the SimpleHelp service account.
Frequently Asked Questions
Is CVE-2024-57726 being actively exploited?
Yes. CISA added CVE-2024-57726 to the KEV catalog on April 24, 2026, and both Microsoft and Trend Micro have linked the SimpleHelp January-2025 CVE cluster to active Storm-1175 / DragonForce ransomware operations. The EPSS score of 0.460 (98th percentile) indicates near-certain continued exploitation activity.
What products are affected by CVE-2024-57726?
SimpleHelp remote support software versions 5.5.7 and earlier are vulnerable. The fix is shipped in SimpleHelp 5.5.8.
How do I fix CVE-2024-57726?
Upgrade to SimpleHelp 5.5.8 or later, revoke and reissue all API keys from previously vulnerable servers, audit technician/admin accounts (MFA, password rotation, removal of unused accounts), and patch the related CVE-2024-57727 and CVE-2024-57728 simultaneously to close the full exploitation chain.
How severe is CVE-2024-57726?
CVE-2024-57726 is rated CRITICAL (CVSS 3.1 score 9.9) with Scope:Changed and full High impact across Confidentiality, Integrity, and Availability. Combined with KEV listing, EPSS 98th-percentile exploitation probability, and ransomware-actor abuse, it is one of the highest-priority vulnerabilities in the SimpleHelp January-2025 advisory cluster.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.