Week Ending: July 5, 2026 | Overall Risk Posture: High

The week ending July 5 looked quiet if measured only by volume. It was not quiet by consequence.

CISA added two exploited vulnerabilities to the Known Exploited Vulnerabilities catalog during the week: a SimpleHelp authentication bypass added on June 29 and a Microsoft SharePoint Server remote code execution flaw added on July 1. The count was small. The pattern was not.

Both vulnerabilities sit on trusted enterprise platforms. SimpleHelp is used for remote support and management. SharePoint is used for collaboration, documents, intranet workflows, and internal knowledge. Neither issue is simply another patch-management item. Both expose a deeper problem: the systems organizations trust to administer, connect, and organize their environments are becoming direct paths into those environments.

The SimpleHelp flaw, CVE-2026-48558, is an OIDC authentication bypass caused by missing verification of identity-token signatures. In vulnerable configurations, a remote unauthenticated attacker can submit forged identity claims and obtain a technician session. The SharePoint flaw, CVE-2026-45659, turns ordinary Site Member access into remote code execution on on-premises SharePoint Server.

This was a week about trust boundaries failing in two directions: unauthenticated access becoming technician access, and low-privilege collaboration access becoming server-side code execution.

• SimpleHelp turned identity trust into technician access
  CISA added CVE-2026-48558, a SimpleHelp authentication bypass vulnerability, to the KEV catalog on June 29 with a July 2 remediation deadline.
  
  The flaw affects SimpleHelp versions 5.5.15 and earlier, along with 6.0 pre-release versions. The vulnerability sits in the OpenID Connect authentication flow. When OIDC authentication is configured, vulnerable SimpleHelp servers may accept submitted identity tokens without verifying the token's cryptographic signature. That means a remote unauthenticated attacker can forge identity claims and obtain a fully authenticated technician session.
  
  The technician role is the heart of the risk. A technician session is not a passive login. In remote support and management software, that role can reach managed endpoints, run scripts, and interact with systems across the environment. Horizon3.ai reported that vulnerable OIDC configurations can allow attackers to create and authenticate as a new technician user, and that MFA can be bypassed in some setups because the attacker can self-register an MFA method on first login.
• SharePoint Server turned ordinary collaboration access into RCE
  CISA added CVE-2026-45659, affecting on-premises Microsoft SharePoint Server, to the KEV catalog on July 1 with a July 4 remediation deadline.
  
  The flaw is a deserialization of untrusted data issue with a CVSS score of 8.8. An attacker sends a crafted serialized payload, and SharePoint reconstructs and executes attacker-controlled objects without validating their types. The resulting code runs inside the SharePoint worker process, w3wp.exe, under the application pool's service identity.
  
  The affected products are SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016, including Enterprise Server 2016. SharePoint Online, the Microsoft 365 cloud service, is not affected.
• The dangerous part is the starting point
  These two flaws are different technically, but similar operationally. SimpleHelp reduces the requirement to no valid credentials in vulnerable OIDC configurations. SharePoint reduces the requirement to ordinary Site Member access. In both cases, the attacker's path begins below the level defenders usually treat as catastrophic.
  
  That is why this week matters. The platform does not need to be obscure to be risky. It only needs to be trusted, reachable, and under-monitored.

• Remote support tools are treated like utilities, not control planes
  SimpleHelp is not just another application. It is a remote management layer. If a technician session can be forged, the attacker is not merely logging into a web portal. They are reaching toward the same operational surface administrators use to support endpoints.
• SSO is trusted before it is verified
  OIDC is supposed to move authentication trust to the identity provider, but that trust depends on cryptographic validation. If a relying application accepts unsigned or unverified identity assertions, the SSO layer becomes a bypass instead of a control.
• Low-privilege roles are under-scoped and over-distributed
  Site Member access is normal SharePoint access. It accumulates across employees, contractors, and partners. When that role is enough to trigger server-side code execution, permission hygiene becomes a frontline security control.
• Patch status and compromise status get confused
  A patched SimpleHelp server or SharePoint farm is not automatically a clean one. Both platforms can provide useful post-exploitation paths. Remediation should trigger log review, account review, and integrity checks.
• Exposure reviews miss management and collaboration platforms
  Organizations often map internet-facing VPNs, firewalls, and web applications, while remote support tools and internal collaboration systems receive less scrutiny. That is exactly where this week's risk landed.

• Patch SimpleHelp immediately
  Update SimpleHelp 5.5.x systems to 5.5.16 and 6.0 pre-release systems to 6.0 RC2. If patching is delayed, restrict where technicians can authenticate from and reduce exposure until the update is complete.
• Review SimpleHelp technician accounts and logs
  Check for unfamiliar technician names or email addresses, especially group-authenticated users. Review SimpleHelp server logs for unusual technician registration activity, configuration changes, or unexpected login patterns.
• Patch on-premises SharePoint immediately
  Apply Microsoft's late-May 2026 updates across SharePoint Server Subscription Edition, 2019, and 2016. Confirm the current farm build in the SharePoint Management Shell rather than assuming the update landed cleanly.
• Audit Site Member and broader SharePoint permissions
  Remove stale contractor and partner access, tighten membership on sites that hold sensitive data, and restrict access to trusted users until patching is complete.
• Hunt for post-exploitation, not just missing patches
  For SimpleHelp, look for unfamiliar technicians and suspicious management activity. For SharePoint, look for unexpected child processes spawned by w3wp.exe, new or modified .aspx files, web shells, and anomalous outbound connections.
• Reduce direct internet exposure
  Remote support and on-prem collaboration platforms should not be casually exposed. Put them behind strong access controls, enforce source restrictions where possible, and verify that discovery scans match reality.

• RMM remains a high-value intrusion surface
  Remote management tools compress the distance between initial access and operational control. Any vulnerability that grants a technician-level session deserves incident-response urgency, not routine application-patching treatment.
• Identity bugs are becoming control-plane bugs
  A missing token-signature check sounds narrow, but the result is broad: forged identity becomes trusted access. That is the kind of flaw that cuts underneath MFA, role assignment, and normal login telemetry.
• Low-privilege RCE is the pattern that matters
  Attackers increasingly need only a foothold-level account to reach code execution on a trusted platform. Flaws that demote the privilege bar from admin to ordinary user change the value of every stolen credential.
• Three-day deadlines are now normal
  SimpleHelp carried a July 2 KEV deadline. SharePoint carried a July 4 deadline. Monthly patch cycles are not aligned with the current exploitation timeline.
• The quiet backlog is still the danger zone
  Both items show why deferred updates on trusted platforms should be weighted by platform role, not only by patch volume or initial severity framing.

The week ending July 5 was light in count and heavy in meaning. Two KEV additions, both tied to platforms organizations trust deeply: one for remote support, one for collaboration.

SimpleHelp shows how an identity validation failure can become remote management access. SharePoint shows how ordinary collaboration permissions can become server-side execution. In both cases, the attacker starts from a position defenders may underestimate.

This is the same theme that has run through recent weeks: trust. Controllers, bridges, PLM, voice infrastructure, collaboration platforms, and remote management tools are not side systems. They are connective tissue. When they fail, the blast radius follows the trust they were given.

The practical lesson is simple. Patch the named vulnerabilities, but do not stop there. Ask which platforms can administer endpoints, trust identity assertions, host sensitive files, or execute code after a low-level login. That list is the real attack surface.

Two exploited vulnerabilities entered the KEV catalog this week, and both point to the same enterprise weakness: trusted platforms are often monitored like ordinary applications even when they function like control planes.

For defenders, the immediate task is clear: patch SimpleHelp and SharePoint, verify exposed assets, review technician and SharePoint membership, and hunt backward for signs of abuse before the update landed.

The larger lesson outlasts both CVEs. A system that can manage endpoints, validate identity, host critical documents, or run server-side code is not just another box in the patch queue. It is a trust boundary. And this week showed how quickly those boundaries can collapse when the starting requirement is no login, or the kind of login almost everyone already has.

The attacker does not need to break every wall. Sometimes they only need the platform your organization already trusts to open the door.