Public Exploit Targets Cleo Harmony JWT Authentication Bypass

A public proof-of-concept exploit is available for CVE-2026-84115, a high-severity authentication-bypass and privilege-escalation flaw in Cleo Harmony's JWT refresh-token handling. Remote attackers can manipulate Bearer-token arguments sent to the /api/connections endpoint to bypass access controls and obtain elevated, potentially administrative, permissions; some attack paths may not require valid credentials.

The vulnerability affects Cleo Harmony versions through 5.8.1.10 and could expose managed file-transfer data or enable manipulation of connected integration workflows, particularly on internet-exposed deployments. Cleo fixed the issue in version 5.8.1.11; organizations should upgrade immediately and review API and token activity for suspicious requests while remediation is underway. No confirmed in-the-wild exploitation of this specific flaw was reported.