[KEV] CVE-2024-57726 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2024-57726 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2024-57726 is a missing authorization vulnerability in SimpleHelp's remote support platform that allows low-privileged technician accounts to create API keys with elevated permissions beyond their intended access level.

Technical Detail

The flaw exists because SimpleHelp fails to enforce proper authorization checks when technician-level users request the creation of API keys, permitting those users to generate keys with permissions exceeding their assigned role. An attacker with a valid low-privileged technician account can exploit this by issuing API key creation requests that are not validated against the user's actual permission scope. The resulting API keys can be leveraged to escalate privileges to the server administrator role, granting full control over the SimpleHelp server instance.

Exploitation Status

The exploit is rated as operational, meaning functional exploit code or techniques are available and have been demonstrated in practice beyond a proof-of-concept stage. CISA has confirmed active exploitation in the wild, adding this vulnerability to the Known Exploited Vulnerabilities catalog on April 24, 2026. Organizations running affected SimpleHelp versions should treat this as an actively targeted vulnerability requiring immediate action.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. Given that SimpleHelp is a remote support tool commonly deployed in managed service provider environments, exploitation of this vulnerability would be consistent with threat actors targeting MSP infrastructure to gain downstream access to client networks, but no named groups have been formally attributed to campaigns exploiting this CVE.

What To Do

Apply the vendor-supplied patch for SimpleHelp immediately. Per CISA's Known Exploited Vulnerabilities catalog, federal agencies operating under BOD 22-01 are required to remediate this vulnerability or apply approved mitigations by the deadline associated with the April 24, 2026 KEV listing. Organizations should audit existing API keys for unauthorized or anomalous entries, revoke any keys that cannot be verified as legitimately created, and review technician account activity logs for signs of unauthorized API key generation. If patching cannot be completed immediately, consider restricting technician account access and disabling API key creation capabilities until the patch is applied. Monitor authentication and API usage logs for privilege escalation indicators.