CVE-2024-57727Vulnerability
SimpleHelp Path Traversal Vulnerability
Reported by 3 independent sources · first reported by Group-IB · last reported
Last reported yesterday
Fix due 6 Mar 2025
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
4 reports, newest first · the exact sentence from each-
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions“CVE-2024-57727 (SimpleHelp path traversal) (Actively exploited)”
-
INC and The Gentlemen Ransomware: Exposed AI Infrastructure“…le (per operator records): FortiClient EMS (CVE-2026-35616, 2,236 targets, 108 created admins, 4,140 managed endpoints), SimpleHelp (CVE-2024-57727, 242 unique IP addresses impacted) and cPanel (CVE-2026-41940, 49+ claimed breaches)”
-
Ransomware in 2026: Same Business, New Rules“Beyond competitor absorption, DragonForce exploited multiple vulnerabilities in SimpleHelp RMM (CVE-2024-57726, CVE-2024-57727, CVE-2024-57728) to compromise managed service providers and deploy ransomware across multiple client networks simultaneously.”
-
Six Supply Chain Attack Groups to Watch Out for in 2026“In 2025, DragonForce exploited many vulnerabilities in SimpleHelp RMM (CVE-2024-57726, CVE-2024-57727, CVE-2024-57728), gaining access to MSP environments.”
Indicators reported together
named in the same reports- 45.227.254[.]43in 2 reports
- trulitesupport[.]comin 1 report
- 45.227.254[.]45in 1 report
Copy these 3 indicators · defanged
Also named with it: CVE-2026-35616, CVE-2024-57726, CVE-2024-57728, CVE-2026-41940, CVE-2026-42208, CVE-2025-49113, CVE-2026-15409, CVE-2026-63030, CVE-2020-1472, CVE-2024-55591, CVE-2024-21762, CVE-2021-42278, CVE-2021-1675, CVE-2025-0282, CVE-2026-9082, CVE-2024-49112, CVE-2025-66568
Thanks — we review every report.