CVE-2026-48558 IBM QRadar · QRadar

Detect CVE-2026-48558 — SimpleHelp Authentication Bypass (CWE-347) in IBM QRadar

Detects exploitation of CVE-2026-48558, an authentication bypass vulnerability in SimpleHelp remote support software caused by improper verification of cryptographic signatures (CWE-347). This KEV-listed vulnerability allows unauthenticated attackers to bypass authentication controls. SimpleHelp is commonly used by MSPs and IT support teams, making it a high-value target for initial access and lateral movement.

MITRE ATT&CK

Tactic
Initial Access Persistence Lateral Movement

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  "HTTP Response Code" AS http_status,
  "HTTP Method" AS http_method,
  LOGSOURCENAME(logsourceid) AS log_source,
  starttime,
  endtime,
  COUNT(*) AS request_count
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Nginx', 'Juniper WebApp Secure')
  AND (
    URL ILIKE '%/admin%'
    OR URL ILIKE '%/operator%'
    OR URL ILIKE '%/technician%'
    OR URL ILIKE '%/api/admin%'
  )
  AND "HTTP Response Code" IN (200, 302)
  AND (username IS NULL OR username = '-' OR username = '')
  AND LAST 7 DAYS
GROUP BY sourceip, destinationip, destinationport, URL, username, http_status, http_method, log_source
HAVING request_count >= 1
ORDER BY request_count DESC
critical severity low confidence

QRadar AQL query detecting unauthenticated successful HTTP responses from SimpleHelp privileged endpoints. Absence of username field combined with HTTP 200/302 on admin paths indicates authentication bypass.

Data Sources

QRadar Log Source - Web ServerQRadar Network Activity

Required Tables

events

False Positives & Tuning

  • Web application firewalls or reverse proxies that do not propagate username fields in forwarded logs
  • Internal IT support staff accessing SimpleHelp from trusted network segments
  • Automated service account access where credentials are not logged by the web server
  • QRadar log source configurations that do not parse authentication fields from SimpleHelp logs

Other platforms for CVE-2026-48558

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2026-48558 — Unauthenticated Admin Endpoint Access Probe

    Expected signal: Web server access logs will show GET requests to /admin, /operator, /technician, and /api/admin from the test host IP. Network flow data will show connections from test host to SimpleHelp port. IDS/IPS may generate HTTP policy violation alerts.

  2. Test 2CVE-2026-48558 — Signature Verification Bypass via Malformed Token

    Expected signal: Application logs should show authentication attempts with malformed tokens. Web server logs will record requests with Authorization headers containing invalid credentials. Endpoint detection may flag the curl process making connections to internal services.

  3. Test 3CVE-2026-48558 — Post-Bypass Operator Account Enumeration

    Expected signal: Multiple sequential API requests to /api/admin/* paths from single source IP within short timeframe. Application logs show operator/technician/config endpoint access. UEBA tools may flag unusual API access patterns if baselining is in place.

Last updated: 2026-06-30 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify all SimpleHelp server instances in the environment by querying asset inventory and CMDB for hosts running SimpleHelp on ports 80, 443, 5850, or 5900. Cross-reference with network flow data to confirm active services.
  2. Review SimpleHelp server access logs for the 7 days prior to detection for requests to /admin, /operator, /technician, and /api/admin paths returned with HTTP 200 or 302 without valid session cookies or authentication tokens.
  3. Determine if the source IP is internal (IT staff, monitoring) or external (internet-facing exploit attempt). Check threat intelligence feeds for the source IP against known scanner/attacker infrastructure.
  4. Verify the current SimpleHelp version on all instances against the patched version referenced in the vendor advisory at https://simple-help.com/security/simplehelp-security-update-2026-05. Unpatched instances are confirmed vulnerable.

Containment

  1. Immediately isolate or firewall-restrict internet-facing SimpleHelp servers if exploit activity is confirmed. Block external access to SimpleHelp ports (5850, 5900, 80, 443) at the perimeter firewall while maintaining internal access for patching operations.
  2. Revoke all active SimpleHelp operator and technician sessions and rotate administrative credentials. Force re-authentication on all accounts and audit for any accounts created or modified during the suspected compromise window.
  3. Apply the vendor security patch from https://simple-help.com/security/simplehelp-security-update-2026-05 immediately on all SimpleHelp instances. Validate patch application by confirming version number post-update.

Evidence Collection

  1. Collect full SimpleHelp server-side logs from the web server, application, and system logs for the entire suspected exploitation window. Preserve originals with cryptographic hash (SHA-256) before any remediation actions alter log state.
  2. Capture network packet captures (PCAP) from the SimpleHelp server's network interface for the exploitation timeframe if available from TAP/SPAN or NDR solutions. Include full session data for any authenticated sessions originating from suspicious source IPs.
  3. Enumerate all remote sessions established via SimpleHelp during the suspected exploitation window — including session IDs, connecting IP addresses, technician accounts used, and client machines accessed — from SimpleHelp's session audit logs.

Escalation Criteria

  • !Escalate immediately to incident response if evidence shows a remote session was established to any endpoint through SimpleHelp by an unauthenticated or unrecognized actor, indicating active intrusion via this vulnerability.
  • !Escalate to CISO and legal counsel if SimpleHelp was used to access systems containing PII, financial data, or regulated information (HIPAA, PCI-DSS, SOX), as breach notification obligations may be triggered under applicable regulations.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >SimpleHelp server-side application logs (default location varies by OS installation: /opt/SimpleHelp/logs/ on Linux, C:\Program Files\SimpleHelp\logs\ on Windows) containing session establishment records and authentication events
  • >Windows Event Logs (Security 4624/4625, System 7045) on endpoints that received SimpleHelp remote sessions during the exploitation window — look for unusual process creation under SimpleHelp service context
  • >Network flow records (NetFlow/IPFIX) showing unusual volume or geographic origin of connections to SimpleHelp service ports, particularly connections from Tor exit nodes or VPS infrastructure
  • >SimpleHelp database files containing session history, operator account modifications, and configuration changes made during the suspected compromise window

Tuning Guidance

Begin with high-sensitivity detection on external-facing SimpleHelp instances only. Suppress alerts from known internal monitoring IP ranges and IT support subnets after confirming those IPs in an allowlist. Correlate with asset inventory to exclude non-SimpleHelp web servers generating false positives on similar URL patterns. If SimpleHelp is only internally accessible, raise confidence threshold and reduce alert frequency. Consider enriching with GeoIP to flag authentication bypass attempts from unexpected geographic regions as high priority. The CWE-347 (Improper Verification of Cryptographic Signature) nature of this vulnerability means exploit attempts may not generate HTTP error codes — focus on successful (200) responses to privileged paths as primary signal rather than failed authentication attempts.

Hunting Queries

Hunt for SimpleHelp processes spawning unexpected child processes on endpoints that received remote support sessions — may indicate post-exploitation command execution through the support session

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where InitiatingProcessFileName has_any ("SimpleHelp.exe", "SimpleHelp", "shagent", "SimpleHelpServer")
| where FileName !in ("SimpleHelp.exe", "shagent", "java.exe", "javaw.exe", "cmd.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc
Hunting — SPL
spl 
index=endpoint sourcetype=crowdstrike:events:sensor OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval parent_proc=coalesce(ParentImageFileName, ParentImage)
| where like(parent_proc, "%SimpleHelp%") OR like(parent_proc, "%shagent%")
| where NOT (process_name IN ("SimpleHelp.exe", "shagent.exe", "java.exe", "javaw.exe"))
| table _time, host, parent_proc, process_name, CommandLine
| sort -_time

Hunt for new SimpleHelp operator or administrator account creation events in the days following the vulnerability disclosure, which may indicate attacker persistence via account creation after authentication bypass

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| where DeviceVendor has "SimpleHelp" or Activity has_any ("operator created", "admin created", "account created", "new technician")
| where Severity in ("Notice", "Warning", "Error")
| project TimeGenerated, Activity, SourceIP, DestinationIP, SourceUserName, Message
| order by TimeGenerated desc
Hunting — SPL
spl 
index=simplehelp OR index=application sourcetype=simplehelp:audit OR sourcetype=simplehelp:log
| search "operator created" OR "admin created" OR "new account" OR "technician added"
| table _time, host, src_ip, user, action, message
| sort -_time

Atomic Red Team Tests

Test 1 CVE-2026-48558 — Unauthenticated Admin Endpoint Access Probe
linux

Simulates the authentication bypass by sending unauthenticated HTTP GET requests to SimpleHelp administrative endpoints. Tests whether the server returns HTTP 200 without valid credentials, confirming vulnerability to CVE-2026-48558.

Command

bash 
TARGET_HOST="http://simplehelp-test.lab.internal:5850"; for path in /admin /operator /technician /api/admin; do echo "[*] Testing: ${TARGET_HOST}${path}"; curl -s -o /dev/null -w "Path: %{url_effective} | HTTP Status: %{http_code}\n" -L --max-redirs 3 --connect-timeout 5 "${TARGET_HOST}${path}"; done

Cleanup

bash 
No cleanup required — read-only HTTP probe with no persistent changes to target system.

Expected Telemetry

Web server access logs will show GET requests to /admin, /operator, /technician, and /api/admin from the test host IP. Network flow data will show connections from test host to SimpleHelp port. IDS/IPS may generate HTTP policy violation alerts.

Expected Detection

Detection rule should fire on HTTP 200 or 302 responses to privileged paths without authentication session. SIEM alert should include source IP, target path, HTTP status code, and absence of username field.

Test 2 CVE-2026-48558 — Signature Verification Bypass via Malformed Token
linux

Simulates the CWE-347 signature bypass by sending requests with malformed or empty cryptographic tokens to the SimpleHelp authentication endpoint, testing whether the application accepts invalid signatures.

Command

bash 
TARGET_HOST="http://simplehelp-test.lab.internal:5850"; echo "[*] Testing with empty Bearer token"; curl -s -o /tmp/simplehelp_empty_token.txt -w "HTTP Status: %{http_code}\n" -H "Authorization: Bearer " -H "Content-Type: application/json" "${TARGET_HOST}/api/admin"; echo "[*] Testing with malformed JWT structure"; curl -s -o /tmp/simplehelp_malformed_jwt.txt -w "HTTP Status: %{http_code}\n" -H "Authorization: Bearer eyJhbGciOiJub25lIn0.eyJ1c2VyIjoiYWRtaW4ifQ." -H "Content-Type: application/json" "${TARGET_HOST}/api/admin"; echo "[*] Results saved to /tmp/simplehelp_*.txt"

Cleanup

bash 
rm -f /tmp/simplehelp_empty_token.txt /tmp/simplehelp_malformed_jwt.txt

Expected Telemetry

Application logs should show authentication attempts with malformed tokens. Web server logs will record requests with Authorization headers containing invalid credentials. Endpoint detection may flag the curl process making connections to internal services.

Expected Detection

Detection should fire if HTTP 200 is returned on the /api/admin endpoint when malformed token is used. The 'alg:none' JWT variant is a classic CWE-347 bypass indicator and may trigger specific WAF or SIEM signature matches.

Test 3 CVE-2026-48558 — Post-Bypass Operator Account Enumeration
linux

Simulates post-exploitation activity following authentication bypass — enumerating existing operator and technician accounts via the SimpleHelp API to establish persistence. Lab environment only.

Command

bash 
TARGET_HOST="http://simplehelp-test.lab.internal:5850"; echo "[*] Enumerating operators via unauthenticated API"; curl -s -w "\nHTTP Status: %{http_code}\n" -H "Content-Type: application/json" "${TARGET_HOST}/api/admin/operators" | python3 -m json.tool 2>/dev/null || echo "Raw response saved"; echo "[*] Enumerating technicians"; curl -s -w "\nHTTP Status: %{http_code}\n" "${TARGET_HOST}/api/admin/technicians" | python3 -m json.tool 2>/dev/null || echo "Raw response"; echo "[*] Checking server configuration endpoint"; curl -s -w "\nHTTP Status: %{http_code}\n" "${TARGET_HOST}/api/admin/config" | python3 -m json.tool 2>/dev/null || echo "Raw response"

Cleanup

bash 
No persistent changes made — all read-only API enumeration. Review SimpleHelp access logs and clear test entries from SIEM if needed.

Expected Telemetry

Multiple sequential API requests to /api/admin/* paths from single source IP within short timeframe. Application logs show operator/technician/config endpoint access. UEBA tools may flag unusual API access patterns if baselining is in place.

Expected Detection

SIEM correlation rule should detect enumeration pattern: multiple requests to distinct /api/admin/* paths from same source IP within 5-minute window without authentication. Alert should classify as reconnaissance following authentication bypass.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0003PersistenceTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1133External Remote ServicesT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections