Missing Authorization in SimpleHelp Could Allow Privilege Escalation to Server Admin (CVE-2024-57726)
The remote support/RMM tool SimpleHelp has a missing-authorization flaw that lets a low-privilege technician create an overly privileged API key and escalate to server administrator. It is listed in CISA's Known Exploited Vulnerabilities catalog and has been used in ransomware campaigns.
Key facts
- CVE IDCVE-2024-57726
- CVSS base score9.9 CRITICAL
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Affected (vendor / product)SimpleHelp SimpleHelp
- CWECWE-862
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2026-05-08 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Affects SimpleHelp's remote support / RMM product SimpleHelp (CVE-2024-57726).
- The weakness type is Missing Authorization.
- A low-privilege technician can create an overly privileged API key and escalate to server administrator.
- Added to CISA KEV on 2026-04-24, confirmed in ransomware use (remediation due 2026-05-08).
- Official NVD CVSS score is 9.9 (CRITICAL).
SimpleHelp is a remote support / RMM (Remote Monitoring and Management) tool that lets technicians connect to users' devices to provide support and manage operations. RMM refers to managing and operating many endpoints from a single console. Because such tools concentrate strong control over a large number of devices, a compromise of their administrative functions can spread quickly to the customer and internal endpoints they reach.
This flaw is a missing authorization issue: an action that should be permitted only after a proper permission check can be carried out without sufficient verification. Specifically, a low-privilege technician can create an overly privileged API key (the secret string a program uses to access a service) and use it to escalate to server administrator (server admin) privileges. The ability to be promoted from a low role to an administrator role is what makes this issue serious.
CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on 2026-04-24 and identifies it as confirmed in ransomware use. Under Binding Operational Directive (BOD) 22-01, U.S. federal agencies are directed to remediate by 2026-05-08. The indicated response is to apply mitigations per the vendor's instructions and, if mitigations are not possible, to discontinue use of the product. Known exploitation of a foundational tool like RMM tends to be targeted as a foothold for intrusion, making this a matter to treat with the highest priority.
Why it matters
Because RMM is a foundational layer that ties together many internal and external endpoints, takeover of administrative privileges can spread broadly, and confirmed ransomware use makes the potential impact on business continuity substantial. With a CISA KEV listing and a stated remediation deadline, organizations using the affected product should prioritize review and response.
FAQ
Why is a vulnerability in an RMM tool significant?
What does 'missing authorization' mean?
What response is required?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).