Is CVE-2024-57728 (SimpleHelp Path Traversal) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2024-57728 to its Known Exploited Vulnerabilities catalogue on 24 April 2026, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e.

What CISA’s KEV Listing Means for This CVE

CISA’s KEV catalogue is a practical signal, not a theoretical one: if a flaw is listed there, defenders should treat it as actively exploited and prioritise exposure reduction immediately. For this case, the immediate question is whether SimpleHelp is present, whether internet-exposed instances exist, and whether any admin workflows or file-transfer features are reachable from untrusted networks.

When a vulnerability reaches this stage, the key operational issue is usually not whether exploitation is possible, but whether the environment still contains reachable instances that can be targeted before maintenance catches up. That is why CISA Known Exploited Vulnerabilities Catalog should be used alongside the vendor advisory to confirm remediation status and the expected action.

How Path Traversal Becomes a Real Attack Path

Path traversal flaws matter because they let an attacker influence where the application reads or writes on disk, which can turn a normal administrative feature into arbitrary file placement. In the direct answer for this CVE, the dangerous behaviour is file upload to arbitrary filesystem locations through a crafted archive, which means the impact is determined by what the application can overwrite, create, or plant in sensitive paths.

That creates a practical distinction between “harmless upload bug” and “system compromise condition.” If the application runs with enough privilege, arbitrary file placement can become persistence, configuration tampering, web-root modification, or a stepping stone to code execution. The broader mechanics are covered well in Web Application Attacks Guide, which includes path traversal and related file-access abuse patterns.

What Defenders Should Check Before and After Remediation

Start with exposure confirmation, then check whether the vulnerable SimpleHelp instance has been reachable by untrusted users, exposed to the internet, or used in a way that would allow uploaded content to influence files outside the intended directory. If patching is delayed, the priority is containment, not optimism: remove public access, restrict administrative paths, and assume any reachable instance may already have been probed.

Because path traversal can leave few obvious indicators, post-exploitation review matters even when the service is still running normally. Look for unexpected files, changed application configuration, newly created archives, web content changes, unusual timestamps, and any sign that the application wrote beyond its normal storage area. Vulnerability Management Guide is the right operational lens for prioritising KEV-listed flaws, tracking remediation, and validating that the fix actually reduced exposure.

Risk and Threat Considerations

Once a flaw is publicly known to be exploited, the threat shifts from abstract vulnerability management to active adversary pressure. In practice, this means scan-and-hold environments become easy targets, and file-write primitives are especially valuable because they can support persistence, tampering, or later-stage payload staging even when the initial entry point looks narrow.

Failure mechanism: An attacker abuses directory traversal or archive extraction logic to write or place files outside the intended directory, then leverages those files to alter application behaviour or support follow-on compromise.

Impact: The result can range from integrity loss and unauthorised file changes to broader system compromise, especially if the service account has elevated filesystem rights or the application exposes sensitive administrative functions.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP ASVS, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP ASVS	V5 — File Handling	Path traversal here is a file handling flaw that enables unsafe writes outside intended directories.
	V15 — Secure Coding and Architecture	The issue reflects unsafe trust in file-processing logic and weak architectural containment.
Recommendation — Validate archive and file paths before write operations and restrict uploads to approved storage locations. Harden file-processing flows so untrusted input cannot influence filesystem targets or privileged operations.
NIST SP 800-53 Rev 5	SI-10 — Information Input Validation	The exploit depends on insufficient validation of crafted file input and traversal sequences.
	CM-7 — Least Functionality	Limiting service capabilities reduces what arbitrary file writes can modify or persist on the host.
Recommendation — Apply input validation to reject path traversal sequences and unsafe archive extraction paths. Reduce the application’s filesystem and runtime privileges to the minimum needed for operation.
CIS Controls v8	CIS-07 — Continuous Vulnerability Management	KEV-listed exploitation makes prioritised identification and remediation of the vulnerable service essential.
Recommendation — Prioritise remediation of KEV-listed instances and verify exposure reduction after fix deployment.

Practitioner Guidance

What to prioritise: Treat this as an exposure-management issue first. Confirm whether SimpleHelp is deployed, whether any instance is externally reachable, and whether the vulnerable administrative path can be reached by untrusted users.

What to verify: After remediation, verify not just that the version or configuration changed, but that the instance can no longer accept unsafe file placement and that no unexpected files, jobs, or configuration changes remain on disk.

Decision rule: If you cannot patch immediately, isolate the service, remove internet exposure, and assume possible compromise until you have reviewed filesystem artefacts and application logs around the exploitation window.

Practitioner takeaway: For KEV-listed path traversal issues, the useful question is not “can it be exploited?” but “what did it already touch, and what can it still reach if left exposed?”

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org