CVE-2024-57727, a path traversal vulnerability in SimpleHelp RMM enabling unauthenticated file read, is being actively exploited by INC Ransomware as an initial access vector. SimpleHelp RMM instances exposed to the internet are viable entry points for the INC kill chain, which proceeds through credential dumping and ransomware deployment.