Exploit Published for Fresh Cleo Harmony Vulnerability

CVE-2026-84115 is an authentication bypass vulnerability in Cleo Harmony's file transfer application affecting the JWT refresh token logic. Remote attackers can manipulate HTTP header arguments, specifically bearer tokens, to bypass access controls and escalate privileges. The vulnerability resides in an unknown function within the '/api/connections' file. Exploitation involves crafting malicious payloads that tamper with or replay bearer tokens, allowing attackers to maintain persistent access and potentially move laterally within integrated systems. An exploit has been publicly released, raising the threat level. Cleo addressed the vulnerability in version 5.8.1.11 but did not disclose detailed technical information in their advisory.

Successful exploitation allows remote attackers to bypass authentication mechanisms, escalate privileges, maintain persistent unauthorized access, and potentially move laterally to other systems integrated with Cleo Harmony. The availability of a public exploit increases the likelihood of attacks against vulnerable deployments. Organizations running affected versions without the patch are at significant risk of compromise.

A fix for this vulnerability is available in Cleo Harmony version 5.8.1.11. Organizations should update to this version immediately to remediate the issue. Cleo's advisory does not require additional actions beyond applying the update. No other mitigations are specified.