Authentication Bypass in Remote Support Tools and libssh2 Flaw

On 29 June 2026, CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalogue, confirming active exploitation of an authentication bypass in SimpleHelp remote support software. The flaw allows attackers to forge identity tokens and gain full technician access without credentials or multi-factor authentication. Because the vulnerability exists in IT providers’ infrastructure rather than client systems, UK small businesses face supply chain risk they cannot directly patch or monitor. Separately, CVE-2026-55200, a critical remote code execution vulnerability in libssh2, has a public proof-of-concept exploit available. libssh2 is embedded in numerous server administration and file transfer tools. This episode explains both vulnerabilities in practical terms and provides specific questions businesses should ask their IT providers immediately, including written confirmation of patching status, privileged access controls, and contractual notification obligations for critical security disclosures.

Chapters

• Introduction Corrine introduces the episode’s focus on a confirmed, actively exploited vulnerability affecting remote support software used by IT providers, explaining the trust relationship businesses place in remote access tools.
• SimpleHelp Authentication Bypass: CVE-2026-48558 Detailed explanation of the authentication bypass vulnerability in SimpleHelp’s OIDC implementation, how it bypasses credentials and MFA, CISA’s confirmation of active exploitation, and the supply chain implications for UK small businesses relying on managed service providers.
• Call to Action Request for listeners to follow, rate, review and share the show.
• libssh2 Remote Code Execution: CVE-2026-55200 Explanation of the critical memory corruption vulnerability in libssh2 that allows malicious servers to execute code on connecting clients, the significance of the public proof-of-concept exploit, and the widespread use of libssh2 in server administration tools.
• Conclusion and Action Steps Five specific actions for business owners: requesting written confirmation from IT providers about SimpleHelp patching, reviewing support contracts for vulnerability notification obligations, asking about privileged access management, confirming libssh2 patching status, and setting deadlines for satisfactory responses.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.ncsc.gov.uk/collection/supply-chain-security