Exploit Published for Fresh Cleo Harmony Vulnerability
CVE-2026-84115 is an authentication bypass vulnerability in Cleo Harmony affecting JWT refresh token logic, allowing privilege escalation via HTTP header bearer token manipulation The flaw exists in an unknown function within the '/api/connections' endpoint, enabling attackers to bypass access controls through malformed or replayed tokens A public exploit has been released per VulnDB, significantly raising the risk of active exploitation in the wild Cleo Harmony version 5.8.1.11 patches the vuln
Analysis
TL;DR
- CVE-2026-84115 is an authentication bypass vulnerability in Cleo Harmony affecting JWT refresh token logic, allowing privilege escalation via HTTP header bearer token manipulation
- The flaw exists in an unknown function within the '/api/connections' endpoint, enabling attackers to bypass access controls through malformed or replayed tokens
- A public exploit has been released per VulnDB, significantly raising the risk of active exploitation in the wild
- Cleo Harmony version 5.8.1.11 patches the vulnerability, but the vendor withheld technical details in its advisory
- Cleo Harmony is identified as a high-value ransomware target, with Cl0p previously exploiting a Cleo product vulnerability in late 2024 to exfiltrate data from major organizations
Why It Matters
This vulnerability poses an immediate and critical risk to organizations relying on Cleo Harmony for file transfer operations, especially given that an exploit is already publicly available. The application's status as a preferred ransomware target—demonstrated by the Cl0p group's successful exploitation in late 2024—makes rapid patching essential to prevent data exfiltration, lateral movement, and ransomware deployment.
Technical Details
- Vulnerability Type: Authentication bypass via JWT refresh token logic manipulation, classified as CVE-2026-84115
- Affected Component: An unknown function in the
/api/connectionsendpoint of Cleo Harmony - Attack Vector: Attackers craft malicious payloads that tamper with HTTP header arguments, specifically forging or replaying bearer tokens to bypass JWT refresh token validation and escalate privileges
- Exploitation Method: Involves intercepting legitimate traffic or forging new requests where the JWT refresh token logic is circumvented through malformed or replayed bearer tokens, enabling persistent access and lateral movement
- Patch: Cleo Harmony version 5.8.1.11 addresses the issue, though Cleo provided no technical details about the root cause or fix in its advisory
Industry Insight
- Organizations using Cleo Harmony should prioritize immediate patching to version 5.8.1.11 and audit all JWT token handling in their integration endpoints, as the public exploit lowers the barrier for opportunistic attackers
- The repeated targeting of Cleo products by ransomware groups like Cl0p signals that file transfer applications should be treated as high-priority assets in attack surface management programs, with enhanced monitoring and network segmentation
- The vendor's decision to withhold technical details about the vulnerability in its advisory is concerning; security teams should independently verify their exposure through exploit reproduction testing and deep packet inspection of JWT traffic flowing through their Harmony instances
Disclaimer: The above content is generated by AI and is for reference only.