Nearly 14,000 SimpleHelp Servers Exposed by Critical Authentication Bypass Flaw A critical authentication bypass vulnerability, tracked as CVE-2026-48558, has left nearly 14,000 internet-facing SimpleHelp servers exposed, posing severe risks to enterprises using the remote monitoring and management (RMM) platform. The flaw was discovered by Horizon3.ai through its AI-driven research initiative, Sua Sponte, and affects deployments configured with OpenID Connect (OIDC) authentication, including integrations with Azure Active Directory. The vulnerability stems from improper validation of identity provider assertions during the OIDC authentication process, allowing unauthenticated attackers to create a new "Technician" account and log in without credentials. Once inside, attackers gain elevated privileges, enabling them to access managed endpoints, execute scripts, and perform administrative actions. Even systems protected by multi-factor authentication (MFA) are vulnerable, as the flaw permits attackers to bypass MFA by registering their own authentication method during the first login. Exploitation is possible in environments where OIDC authentication is enabled, a TechnicianGroup is linked to the OIDC provider, and group-authenticated logins are permitted settings common in enterprise deployments. Administrators can detect potential compromise by reviewing technician accounts for unfamiliar entries and analyzing server logs for unauthorized registrations or configuration changes. Logs stored in `/opt/SimpleHelp/logs/` may provide additional evidence of malicious activity. The number of publicly accessible SimpleHelp servers has quadrupled since early 2025, rising from 3,400 to nearly 14,000 as of June 2026. Approximately 7.2% of these systems are configured in a way that makes them vulnerable to this flaw. Given SimpleHelp’s role in remote access and endpoint management, successful exploitation could allow attackers to move laterally across networks, compromising critical systems. The vulnerability was discovered on May 21, 2026, reported to the vendor the following day, and publicly disclosed on June 12, 2026. A patch was released on June 9, prior to the advisory. For organizations unable to patch immediately, temporary mitigations such as restricting technician logins by IP address are recommended. The incident underscores the risks associated with RMM tools and the need for secure authentication mechanisms, particularly when integrating with enterprise identity providers.