CVE-2026-48558 SimpleHelp Rogue Technician Account Creation via OIDC Bypass

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•25

This rule detects the creation of unauthorized technician accounts in the SimpleHelp RMM platform that follow an OIDC authentication bypass pattern (CVE-2026-48558). It correlates server logs indicating 'New Anon' registration activity with Windows Security Event ID 4720 (User account created), specifically filtering for accounts that do not belong to trusted corporate domains.