Article
Remote support and file transfer flaws in ransomware attacks
SimpleHelp, CrushFTP, GoAnywhere and BeyondTrust flaws were flagged by CISA for ransomware use in 2025 and 2026. Dates, fixes, attribution and checks.
Read more
Exploited vulnerability
SimpleHelp path traversal (CVE-2024-57727)
CVE-2024-57727
CVE-2024-57727 is a path traversal flaw in SimpleHelp, remote support software that IT teams and service providers use to manage computers.
- On CISA KEV
- CVE ID
- CVE-2024-57727
- CISA KEV
- Listed
- Affected product
- SimpleHelp remote support software
- Exploited
- Yes
- Published
- January 2025
In short
CVE-2024-57727 is a path traversal flaw in SimpleHelp, remote support software that IT teams and service providers use to manage computers. Path traversal means a crafted web request can reach files outside the folders meant to be public. CISA says ransomware actors used it against unpatched servers.
- CVECVE-2024-57727
- ProductSimpleHelp SimpleHelp remote support software
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedUpgrade the server · Reset credentials
What it allows
An attacker with no account can download files from the SimpleHelp server, including the server configuration file with technician account details and hashed passwords. With those, the vendor says an attacker could log in as a technician, reconfigure the server and gain administrator access to machines registered to it. CVSS: 7.5 (NVD, CVSS v3.1). NVD also lists a second, higher score of 9.1 (CVSS v3.1) from another scorer. Two sibling flaws, CVE-2024-57726 (missing authorization on API keys) and CVE-2024-57728 (path traversal by uploading a crafted zip file), need a logged-in user and can lead to full server control.
Who is affected
Per the vendor, SimpleHelp 5.5.7 and all earlier releases are vulnerable to all three CVEs. Version 5.5.8 and later fix them. Patches exist for 5.4.10 and 5.3.9. Service providers are exposed twice: through their own server and through customers whose machines are registered to it.
The vendor published its security notice in January 2025, and NVD recorded the CVE on 15 January 2025. CISA added CVE-2024-57727 to its Known Exploited Vulnerabilities (KEV) catalog on 13 February 2025, and the KEV entry flags known use in ransomware campaigns.
In advisory AA25-163A, released 12 June 2025, CISA wrote that ransomware actors have targeted organizations through unpatched SimpleHelp since January 2025. It says they likely used CVE-2024-57727 to reach the customers of a utility billing software provider, in double extortion attacks (stealing data and encrypting systems).
On 24 April 2026 CISA added the two sibling flaws, CVE-2024-57726 and CVE-2024-57728, to the KEV catalog. Both are also flagged for ransomware use.
Attributed by CISA, FBI and ASD's ACSC in the #StopRansomware Play advisory (AA23-352A): multiple ransomware groups, including initial access brokers with ties to Play ransomware operators, exploited CVE-2024-57727 in SimpleHelp. CISA's June 2025 alert (AA25-163A) says ransomware actors, not named there, used it against a utility billing software provider's customers.
Who exploits it
What to do
-
Upgrade the server
Move to SimpleHelp 5.5.8 or later. If you run 5.4.10 or 5.3.9, apply the vendor patch for that version. Check the version at the /allversions page of your server.
-
Reset credentials
The configuration file may have leaked. The vendor says to change the administrator password and technician passwords that are not tied to a single sign-on service.
-
Restrict and isolate
Limit technician and administrator logins to known IP addresses. CISA says to isolate a vulnerable server from the internet or stop it until it is patched.
-
Tell your customers
Service providers that run SimpleHelp for others should tell downstream customers to check their endpoints and hunt for compromise, as CISA advises.
-
Detect and hunt
Look for three-letter executables created after January 2025, odd traffic from the server, and technician logins from unexpected addresses in the server log.
Questions
What is CVE-2024-57727?
It is a path traversal flaw in SimpleHelp, remote support software. A crafted web request can reach files outside the folders meant to be public, including the server configuration file with technician account details and hashed passwords. No account is needed.
Is CVE-2024-57727 exploited by ransomware groups?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 13 February 2025 and flags known ransomware use. Advisory AA25-163A says ransomware actors targeted unpatched SimpleHelp servers since January 2025, in double extortion attacks.
How do I fix CVE-2024-57727?
Move to SimpleHelp 5.5.8 or later, or apply the vendor patch for 5.4.10 or 5.3.9. Change the administrator and technician passwords, limit logins to known IP addresses, and isolate a vulnerable server from the internet until it is patched.
In our research
Sources
- Security Vulnerabilities (SimpleHelp 5.5.7 and earlier) SimpleHelp
- AA25-163A: Ransomware Actors Exploit Unpatched SimpleHelp RMM CISA
- CVE-2024-57727 record NIST NVD
- Known Exploited Vulnerabilities catalog CISA
- #StopRansomware: Play Ransomware CISA, FBI and ASD's ACSC
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.