CVE-2026-48558 (CVSS 10) SimpleHelp Auth Bypass Actively Exploited via OIDC; Djinn Stealer Deployed Against MSP Stack

CISA added CVE-2026-48558 to the KEV catalog on June 29 after confirmed in-the-wild exploitation: the CVSS 10 authentication bypass in SimpleHelp allows unauthenticated attackers to forge OIDC identity tokens, self-register an MFA method, and create fully privileged Technician accounts — bypassing MFA entirely. Blackpoint MDR documented a threat actor pivoting from the compromised RMM server to deliver a novel cross-platform infostealer dubbed Djinn Stealer, targeting cloud provider credentials, SSH keys, IaC secrets, AI coding-assistant configs (Claude, Gemini, Codex), and crypto wallets. With ~14,000 SimpleHelp servers internet-exposed and 7.2% using OIDC, MSPs and their downstream clients face elevated risk of mass initial-access brokering or ransomware pre-positioning.

With ~14,000 SimpleHelp servers internet-exposed and 7.2% using OIDC, MSPs and their downstream clients face elevated risk of mass initial-access brokering or ransomware pre-positioning.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.