A severe vulnerability in SimpleHelp's remote monitoring and management software has been exploited by cybercriminals to deliver malware and harvest sensitive credentials. Identified as CVE-2026-48558, this flaw carries a maximum CVSS score of ten and is found within the OpenID Connect authentication flow of SimpleHelp. It enables attackers to gain a fully authenticated session without proper authentication by submitting a forged identity token due to the application's failure to validate the cryptographic signature. Once attackers access an internet-exposed SimpleHelp server, they can execute commands and transfer files across all devices managed by the server. In a recent attack investigated by Blackpoint, cybercriminals exploited this vulnerability to deploy two types of malware: TaskWeaver and Djinn Stealer. TaskWeaver, a Node.js loader, facilitates system fingerprinting and deploys JavaScript payloads with full Node.js access. Djinn Stealer, on the other hand, targets developer systems to steal cloud credentials, SSH keys, infrastructure configurations, and other sensitive data, including AI development tool credentials. This vulnerability was addressed in May with updates to SimpleHelp versions 5.5.16 and 6.0 RC2. Organizations are urged to update their software immediately and review application logs for suspicious activity, such as unfamiliar technician names or email addresses, to detect potential breaches. In response to Blackpoint's findings, the US Cybersecurity and Infrastructure Security Agency has added CVE-2026-48558 to its Known Exploited Vulnerabilities catalog, advising federal agencies to apply patches within three days, following BOD 26-04 guidelines.