A vulnerability was found in Cleo Harmony up to 5.8.1.10.

CVE-2026-84115 is an improper privilege management flaw in Cleo Harmony's JWT Refresh Token Handler, specifically in the /api/connections endpoint. By crafting a manipulated Bearer token in the HTTP Authorization header, an unauthenticated remote attacker can trick the application into granting elevated permissions that were never intended for their session. All Cleo Harmony builds from 5.8.1.0 through 5.8.1.10 are affected; version 5.8.1.11 contains the fix. A companion vulnerability, CVE-2026-84114 (SAML authentication bypass via Email argument manipulation), affects the same version range — check for both.

The vendor's CVSS 3.1 score of 8.3 HIGH is defensible but slightly generous. The Changed-scope designation (S:C) bumps the score, yet every individual CIA impact facet is rated Low — meaning the privilege escalation grants broader-than-expected access but does not immediately yield full system compromise or arbitrary code execution. The CVSS 4.0 re-score of 6.9 Medium reflects this reality more honestly. However, the vendor score does *not* account for two real-world amplifiers: the existence of a public exploit (confirmed by VulnDB, reproduced by WatchTowr) and Cleo's well-documented history as a Cl0p ransomware target. These factors keep the reassessed severity firmly in the HIGH bucket despite the limited per-dimension impact.

Why this verdict

• Unauthenticated, network-accessible, low-complexity attack — the CVSS base metrics (AV:N/AC:L/PR:N/UI:N) mean any attacker who can reach the endpoint can exploit it. No credentials, no user interaction, no race condition. This eliminates the most common friction points.
• Public exploit with independent reproduction — VulnDB lists a working exploit, and WatchTowr confirmed reproducibility. This moves the threat from theoretical to practical. EPSS will likely adjust upward.
• Role multiplier: MFT data gateway — Cleo Harmony is a managed file transfer product that by design sits at the network perimeter and handles sensitive B2B data (financial, healthcare, EDI). Privilege escalation on this component exposes all data flowing through it. The blast radius is *data-tier* (mass data egress across all configured transfer partners), not merely host-level. Cl0p's 2024 campaign against Cleo products (CVE-2024-50623) demonstrated exactly this playbook — bulk exfiltration followed by extortion. This role places the floor at HIGH.
• Small but internet-exposed installed base — ~1,300 instances visible on Censys/Shodan. While this is a small footprint compared to Exchange or Fortinet, every one of these instances is a high-value data conduit by definition. The small population prevents an upgrade to CRITICAL but does not justify a downgrade.
• CVSS 4.0 reality check — the v4 rescore of 6.9 Medium accurately reflects that each CIA impact dimension is Low. The privilege escalation grants elevated API access but does not deliver RCE or full system compromise. This caps the reassessed score below the vendor's 8.3.

Why not higher?

The vulnerability does not grant remote code execution, full system compromise, or kernel-level access. Each CIA impact dimension is rated Low, meaning the escalated privileges are bounded — likely elevated API access rather than OS-level admin. The installed base is small (~1,300 exposed instances), and there is no confirmed in-the-wild exploitation or KEV listing for this specific CVE. These factors collectively prevent a CRITICAL rating.

Why not lower?

The attack is unauthenticated and network-accessible with a public exploit — the two highest-friction barriers (authentication and exploit availability) are absent. Cleo Harmony is canonically an internet-facing MFT gateway handling sensitive B2B data, placing it in the high-value data-tier role category. Cl0p's documented targeting of Cleo products creates a credible threat actor with proven interest and capability. Downgrading to MEDIUM would ignore the data-gateway role multiplier and the active threat landscape around this exact product family.

1. Restrict /api/connections to trusted IPs via WAF or network ACL — The exploit targets the /api/connections endpoint specifically. Blocking unauthenticated access to this path from untrusted sources eliminates the remote attack vector entirely. Deploy within 30 days per the noisgate mitigation SLA for HIGH severity, but given the public PoC, aim for days not weeks.
2. Deploy WAF rule to inspect and reject malformed JWT Bearer tokens — Configure your WAF (F5, Cloudflare, AWS WAF, etc.) to validate JWT structure in Authorization headers hitting Cleo endpoints. Reject tokens with unexpected claims, oversized payloads, or missing signature fields. This is a defense-in-depth measure — not a substitute for patching.
3. Monitor /api/connections access logs for anomalous sessions — Create a SIEM alert for any API session on Cleo Harmony that accesses connection configurations or file transfer data outside of known service accounts or admin IPs. Focus on sessions originating from non-allowlisted sources.
4. Audit stored credentials in Cleo Harmony integrations — If exploitation has already occurred, stored credentials for partner integrations (SFTP keys, API tokens, database passwords) should be rotated. Check Harmony audit logs for any unauthorized access to connection configurations since 2026-09-01.
5. Segment Cleo Harmony from internal networks — If not already done, place Cleo Harmony in a DMZ with strict egress filtering. Prevent the Harmony server from initiating connections to internal systems beyond the minimum required for configured file transfers.

Run this script on the Cleo Harmony host or from any machine with curl and network access to the Harmony API. Invoke with: bash check_cve_2026_84115.sh <harmony_url> (e.g., bash check_cve_2026_84115.sh https://harmony.example.com). No special privileges required — it checks the running version via the API.

#!/usr/bin/env bash
# check_cve_2026_84115.sh — Detect CVE-2026-84115 (Cleo Harmony JWT Privilege Escalation)
# Usage: bash check_cve_2026_84115.sh <harmony_base_url>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <harmony_base_url>"
  echo "Example: $0 https://harmony.example.com"
  exit 2
fi

BASE_URL="${1%/}"
VULN_MAX="5.8.1.10"
FIX_VERSION="5.8.1.11"

# Attempt to retrieve version from Harmony's API or login page
VERSION=$(curl -sk --max-time 10 "${BASE_URL}/" 2>/dev/null \
  | grep -oiE 'Harmony[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' \
  | head -1 \
  | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')

if [ -z "$VERSION" ]; then
  # Fallback: try /api or /about endpoint
  VERSION=$(curl -sk --max-time 10 "${BASE_URL}/api" 2>/dev/null \
    | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' \
    | head -1)
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not determine Cleo Harmony version from ${BASE_URL}"
  echo "Manually check: Settings > About in the Harmony admin console."
  echo "Vulnerable versions: 5.8.1.0 through ${VULN_MAX}"
  echo "Fixed version: ${FIX_VERSION}+"
  exit 2
fi

echo "Detected Cleo Harmony version: ${VERSION}"

# Compare versions (dot-separated numeric comparison)
version_lte() {
  [ "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
}

if version_lte "$VERSION" "$VULN_MAX"; then
  if version_lte "5.8.1.0" "$VERSION"; then
    echo "VULNERABLE — Version ${VERSION} is in the affected range (5.8.1.0–${VULN_MAX})"
    echo "ACTION: Upgrade to Cleo Harmony ${FIX_VERSION} or later immediately."
    echo "CVE: CVE-2026-84115 | CVSS 3.1: 8.3 | Reassessed: 7.8 HIGH"
    exit 1
  else
    echo "PATCHED — Version ${VERSION} is below the affected range (pre-5.8.1.0)"
    exit 0
  fi
else
  echo "PATCHED — Version ${VERSION} is at or above the fix version (${FIX_VERSION})"
  exit 0
fi

Sources

1. SecurityWeek — Exploit Published for Fresh Cleo Harmony Vulnerability
2. CybersecurityNews — Cleo Harmony Flaw Lets Remote Attackers Escalate Privileges
3. Offseq Radar — CVE-2026-84115 Threat Intelligence
4. BleepingComputer — CISA confirms critical Cleo bug exploitation in ransomware attacks
5. Censys — 2025 State of the Internet: Notable Incidents (Cleo exposure data)
6. Huntress — Cleo Software Actively Being Exploited in the Wild
7. Rapid7 — Widespread Exploitation of Cleo File Transfer Software