A client advisory from Virtual IT Group (ViTG)
Prepared for: Tampa Bay businesses and IT owners
Date: October 2026
Audience: Business owners, IT leaders, and IT-managed departments
Read time: about 8 minutes
This is an advisory about your business, not about a vendor
If you run a business here in the Tampa Bay area, and you or your IT department use a remote support tool to manage your computers, this advisory is for you.
“Remote support tool” is the plain-language name for what the industry calls an RMM: Remote Monitoring and Management software. It is the quiet program that lets your IT team (and, in many cases, your IT company) see into your computers from away, patch them, and fix problems without walking into your office. SimpleHelp and NinjaOne are two of the most common ones you might already run.
For years that tool has been one of your safest assets. It is the reason your network stays healthy without a technician standing in the back room.
In 2026, attackers started treating that same tool as the door in. Two separate problems surfaced in the same window, and together they change what you should assume about the software you trust:
- A confirmed flaw in SimpleHelp that lets an attacker who has never logged in to your system create a full technician session and reach your computers. This is CVE-2026-48558.
- A wave of RMM phishing attacks, including one using NinjaOne, that trick your people into installing an “RMM tool” that is the attackers’ way in.
We are writing this because the door in is the one you paid to keep locked. The good news is that both problems have clear, fast fixes, and a managed security team can run the checks while we talk.
This advisory does not claim you have been hit. It does not claim anyone in Tampa Bay has been hit. It tells you what is true, what is not yet proven, and the three checks that will tell you whether you are exposed.
What we know, and what we do not
Before you act, you deserve an honest read, not an alarm. The facts below are verified, but two points need honest hedging, and we will name them plainly.
What is confirmed
- CVE-2026-48558 is real and is patched. It is an authentication flaw in SimpleHelp. The vendor, SimpleHelp, fixed it in version 5.5.16 and version 6.0 RC2, and published the fix on May 26, 2026. If you are on 5.5.16 or 6.0 RC2 or later, you are not affected.
- The flaw is serious on paper. It carries a CRITICAL severity rating (9.5 out of 10). The problem is that, under certain settings, SimpleHelp could accept a forged identity token during login without checking its signature. A remote attacker who has never had an account, password, or identity-provider access could submit that forged token and walk out with a full technician session, including the ability to run scripts.
- It only affects a specific setup. The flaw reaches you only if SimpleHelp is set up in a particular way. We cover the three exact conditions in the checklist below.
- RMM tools are a 2026 target. Industry telemetry (from Acronis, covering more than 1.8 million endpoints) shows that the majority of endpoints run more than one remote-access tool at a time, and more than 20 percent run three or more. The more tools you run, the more doors an attacker can try.
- Phishing is the delivery method. A broad RMM-phishing wave touched 46 countries, with roughly 45 percent of activity aimed at the United States. A separate campaign using NinjaOne was still active as of June 2026.
Two honest hedges
We will not oversell. Two things are still unsettled, and a good security team tells you this rather than hiding it.
- “It is being exploited” is not fully settled. CISA placed CVE-2026-48558 on its list of known exploited vulnerabilities, which is a serious step. But at disclosure, one government advisory said it saw no confirmed exploitation in the wild yet. We do not know which to believe, and we would not pretend to. What we do know: the fix exists, it is fast, and the cost of being wrong is high enough that you patch regardless.
- “Full access” does not mean the same thing everyone says it means. You will see the phrase “SYSTEM-level access” in some reports. Our sources describe full technician and administrative access to your managed systems, not a specific operating-system token. We use “full technician access” below, because that is what the sources support.
Neither hedge is a reason to wait. It is a reason to be precise.
Inline CTA: The single fastest way to know whether the SimpleHelp flaw can reach you is to check three settings on your own system, which takes about 10 minutes. Our team has a one-page check you can run yourself, or we can run it for you. If you are in Tampa or Clearwater and would rather we do it, reply to this advisory and we will start.
Part 1: Is the SimpleHelp flaw a risk for you?
This is the part most people get wrong. They read “critical vulnerability” and panic, or they read “patched” and stop reading. Neither is the question. The question is whether your specific setup can be reached.
Why the SimpleHelp flaw matters
An authentication bypass (the technical term is a flaw that lets someone get in without valid credentials) is one of the worst problems a tool can have. Most attacks need a stolen password or a broken login. This one does not. An attacker who has never touched your system can create a technician session from outside, reach your managed computers, and run scripts.
That is why a fix like this is worth acting on even though a full in-the-wild attack is not confirmed. The fix is free, it is fast, and it closes a door that does not need a stolen key to open.
The three conditions that decide your exposure
The flaw reaches you only when three things are all true at the same time. If even one is not true, you are not affected by this specific flaw.
- OIDC authentication is turned on. OIDC is the modern “sign in with your provider” login (think Microsoft 365, Okta, Google, or another identity provider). If you never use it in SimpleHelp, this flaw cannot reach you.
- At least one OIDC provider is configured. That means at least one identity provider is connected to the SimpleHelp login.
- “Allow group authenticated logins” is turned on for a technician group tied to that provider.
If you use SimpleHelp and you do not use those settings, you are not affected by CVE-2026-48558. That is a real and common position. Many practices and small IT shops do not use OIDC at all.
What to do about it
- If you are unsure whether your settings match the three conditions: ask your IT provider to check. You do not need to understand the details; you need the yes or no.
- If you are affected: update to SimpleHelp 5.5.16 or 6.0 RC2 or later. If you are not sure how to patch it, a managed IT team does it for you.
- If you are not affected: you are safe from this specific flaw, but you should still run the phishing checks below, because that risk is not tied to OIDC.
Part 2: The RMM phishing wave
Even if the SimpleHelp flaw cannot reach you, the second problem can, and it does not depend on any setting.
How the RMM phishing attacks work
Attackers send an email that looks like a normal business message, often a document, an invoice, or a notice. Inside is a link to an “RMM tool” that your person is asked to install. The trick is that the tool is real. The installer is a legitimate remote access program. That is exactly the point.
Once it is installed, it looks like the remote support software your IT team already uses. The traffic it sends out looks like normal IT traffic. Your monitoring sees a familiar tool and lets it through. From the outside, it is invisible.
Two specific campaigns are worth knowing about in 2026:
- A NinjaOne-based campaign, where the lure impersonates fiscal or business documents and delivers a real NinjaOne agent the attacker then controls. It targeted organizations in Brazil, and its supporting infrastructure was still active as of June 2026.
- A broader RMM-phishing wave across 46 countries, with about 45 percent of the activity aimed at the United States and roughly 600 linked cases.
The common thread is not the tool. The common thread is that a tool you trust is being used to blend in.
Mid CTA: If you want to see what this looks like on a real system, book a 15-minute call with our team. We will walk you through a sample of the RMM-phishing pattern and tell you whether your current monitoring would have caught it. No commitment, no cost. It is 15 minutes, and it is the fastest way to turn “I hope” into “I know.”
Why this hits Tampa Bay businesses harder
You are not being singled out. But the Tampa Bay area has a shape that makes these two problems land harder here than in a large corporate office.
- More small and mid-size businesses. A large company can staff its own security team. A business with two to 30 people usually does not. The RMM flaw and the RMM phishing both assume you do not have a full-time team watching the logs.
- More RMM tools in play. Acronis’s telemetry shows that the majority of endpoints run more than one remote-access tool, and more than 20 percent run three or more. A Tampa Bay office with a managed IT provider, a bookkeeper’s remote access, and a vendor’s support tool running at once is three doors an attacker can try.
- Less time to detect it. The value of a trusted tool like RMM is that it is invisible when it is working. That same invisibility is why an attacker’s version of it is also invisible. Without someone watching the traffic, a legitimate-looking tool can sit there for days.
That is the risk you are managing. It is not “did an attacker find a bug.” It is “does anyone on your team see the trusted tool that is not yours?”
Part 3 (gated): How a managed SOC sees this
This section is the part that matters if you want to stop reacting and start being watched for you.
A managed Security Operations Center (a SOC is a team or service that watches your security signals around the clock and acts when something looks wrong) changes the equation in two ways.
Detection
The SimpleHelp flaw leaves a specific trail: a configuration-save action that a normal technician would not produce. A SOC is set up to look for exactly that pattern, not to wait for a breach report to arrive by mail.
The RMM phishing leaves a different trail: a remote access tool that was never installed by your IT team. A SOC that knows your approved tools can flag the one that was not.
Response
Detection is only half of it. The other half is response: containing the access, removing the unapproved tool, and resetting the account that was touched. That is work that takes hours if you are doing it yourself, and minutes if someone is already watching.
This is not a promise that a SOC will stop an attack. No one can promise that. What a managed SOC does change is the time between “this is happening” and “it is contained,” and the chance that you find out yourself before an attacker is found by you.
The SOC-as-a-service point, stated plainly: ViTG runs a managed security and SOC service for Tampa Bay businesses. It is a real service you can add, and it is a real next step if you want someone watching your traffic rather than waiting for you to notice. We will not claim it is insurance, because it is not. It is the difference between a door that closes in minutes and one that stays open until you find it.
What to do today, in order
Do not try to do everything at once. Do these in order, because the first three take minutes and the fourth takes a conversation.
1. Check the three SimpleHelp conditions (10 minutes)
Ask your IT provider: is OIDC on, is an OIDC provider configured, and is “allow group authenticated logins” on? If any of the three are on, you are affected and you need to patch.
2. Patch if you are affected
Move to SimpleHelp 5.5.16 or 6.0 RC2 or later. The fix is free and fast. If you are not sure how, a managed IT team does it for you.
3. Turn on multi-factor authentication for your IT team
MFA is multi-factor authentication, the second thing you prove before you get in. It does not stop the SimpleHelp flaw on its own, because that flaw has a path around MFA. But it is still the strongest single control for everything else in your login, and it should be on.
4. Talk to us about your exposure
This is the step that is hard to do yourself: knowing whether you are one of the exposed systems. You have the facts, but not the answer about your own setup. That answer needs a look at your configuration, your installed tools, and your logs.
Closing CTA: If you want that answer, contact ViTG for a free exposure check. We will run the three SimpleHelp conditions, tell you whether the RMM phishing pattern would have been caught by your current monitoring, and show you what a managed SOC would do differently. It is free, it takes one call, and it turns an advisory into a decision. Ready to get started? Contact us today, and we will check your exposure before the next one gets through.
Sources and how confident we are
Every fact above was fact-checked by our research team on October 21, 2026. Our confidence in the core claim, that CVE-2026-48558 is real, patched, and critical, is high. It is confirmed by the vendor (SimpleHelp), the national vulnerability database (NVD), the disclosing researcher (Horizon3.ai), and three government or cyber-alert bodies (CISA, NHS England, and NY IT Services).
We are deliberately less certain about two points, and we named them where they appear:
- Whether CVE-2026-48558 is being exploited in the wild. CISA lists it as exploited; one advisory said it saw no confirmed exploitation. We do not resolve that contradiction in this advisory, and we recommend you patch regardless of it.
- The exact meaning of “full access.” Our sources describe full technician and administrative access, not a specific operating-system token. We use the term the sources support.
If you would like the full source list and the underlying research, it is available on request.
The bottom line
The remote support tool you trust is one of your best assets, and in 2026 it is also one of an attacker’s best doors. The SimpleHelp flaw (CVE-2026-48558) is real and patched. The RMM phishing wave is real and active. Neither one has been confirmed as a Tampa Bay incident, and we will not pretend otherwise.
What we will say is this: the fixes are fast, they are free, and a managed team can run them while you keep running your business. If you are on the affected settings, patch today. If you are not sure, let us check for you.
Ready to get started? Contact ViTG for a free exposure check today, and we will tell you whether your business is exposed before the next one gets through.