Active Exploitation of Cleo File Transfer Flaws Enables Unauthenticated RCE

Attackers are actively exploiting critical vulnerabilities in Cleo Harmony, Cleo VLTrader, and Cleo LexiCom managed file transfer software, including CVE-2024-50623 and the related CVE-2024-55956. The flaws affect versions prior to 5.8.0.24 and allow remote, unauthenticated attackers to upload arbitrary files, execute commands, access sensitive data, and alter systems. Security researchers and vendor advisories reported in-the-wild exploitation, with public proof-of-concept exploit code increasing the risk of broad compromise.

Intrusions linked to the campaign have been associated with Clop data-theft activity, and exploitation was observed from at least early December 2024. Defenders were urged to immediately upgrade affected Cleo products to 5.8.0.24 or later, restrict external access to exposed file transfer servers, and review logs, autorun locations, and other persistence points for suspicious files or commands. The incident adds Cleo software to the list of heavily targeted file transfer platforms exploited for large-scale enterprise breaches.