CVE-2024-57726

nvd.nist.gov • April 27, 2026

SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in SimpleHelp Software Exploited Two critical vulnerabilities have been identified in SimpleHelp remote support software versions 5.5.7 and earlier. CVE-2024-57728 allows admin users to upload arbitrary files, potentially executing arbitrary code on the host system. CVE-2024-57726 enables low-privilege technicians to create API keys with excessive permissions, facilitating privilege escalation to server admin roles. Both vulnerabilities were published on January 15, 2025, and were added to the CISA Known Exploited Vulnerabilities Catalog on April 24, 2026, indicating active exploitation. Organizations using affected versions are at risk of unauthorized access and control. Immediate action is recommended to mitigate these vulnerabilities. Reference CISA's BOD 22-01 for further guidance. 73

Extracted Entities

CVEs (1)

CVE-2024-57726

CWE Weaknesses (1)

CWE-862 - Missing Authorization