CVE-2024-57727: SimpleHelp Path Traversal Vulnerability

Actively exploited: added to CISA’s KEV catalog on February 13, 2025.
Used by ransomware, according to CISA.
Remediation deadline for US federal agencies: March 6, 2025.

Description from CISA’s KEV catalog.

Our analyses

An open server exposed hackers who ran their attacks with Claude AI

SOCRadar says affiliates of the INC and The Gentlemen ransomware had mainstream AI models carry out their intrusions. Here are the flaws they targeted and what to check in your own environment.

Oct 24, 20263 min read

What to do

Check whether your estate includes SimpleHelp SimpleHelp, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Vendor advisory or reference cited by CISA (simple-help.com)
NVD entry (NIST)
CISA KEV catalog

Other SimpleHelp vulnerabilities

CVE-2026-48558Jun 29

SimpleHelp Authentication Bypass Vulnerability
CVE-2024-57728Used by ransomwareApr 24

SimpleHelp Path Traversal Vulnerability
CVE-2024-57726Used by ransomwareApr 24

SimpleHelp Missing Authorization Vulnerability

All exploited SimpleHelp vulnerabilities

Our analyses

An open server exposed hackers who ran their attacks with Claude AI

What to do

References

Other SimpleHelp vulnerabilities

SimpleHelp Authentication Bypass Vulnerability

SimpleHelp Path Traversal Vulnerability

SimpleHelp Missing Authorization Vulnerability