Loading story…
A public proof-of-concept exploit is available for CVE-2026-84115, a high-severity authentication-bypass and privilege-escalation flaw in Cleo Harmony's JWT refresh-token handling. Remote attackers can manipulate Bearer-token arguments sent to the /api/connections endpoint to bypass access controls and obtain elevated, potentially administrative, permissions; some attack paths may not require valid credentials.
The vulnerability affects Cleo Harmony versions through 5.8.1.10 and could expose managed file-transfer data or enable manipulation of connected integration workflows, particularly on internet-exposed deployments. Cleo fixed the issue in version 5.8.1.11; organizations should upgrade immediately and review API and token activity for suspicious requests while remediation is underway. No confirmed in-the-wild exploitation of this specific flaw was reported.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-84115, a critical improper privilege-management flaw in Cleo Harmony's JWT Refresh Token Handler, was disclosed and documented by MITRE. The flaw affects Harmony versions through 5.8.1.10 and can allow bearer-token manipulation at the /api/connections endpoint.
The Cl0p ransomware group exploited a vulnerability in a Cleo product and stole data from major organizations.
VulnDB reported that an exploit for CVE-2026-84115 was released, and other reports described a public proof-of-concept as circulating. The exploit uses manipulated, forged, or replayed Bearer tokens to bypass access controls and potentially gain elevated permissions remotely.
Cleo remediated the CVE-2026-84115 authentication-bypass and privilege-escalation flaw in Cleo Harmony version 5.8.1.11. The issue affects versions through 5.8.1.10 and involves JWT refresh-token handling at the /api/connections endpoint.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcethecyberexpress.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcevuldb.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-5430**, a CVSS 10 authentication-bypass vulnerability affecting WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway. The flaw results from improper JWT signature verification: vulnerable services accept tokens signed with unsupported algorithms, allowing attackers to forge JWTs with administrator privileges and bypass authentication. WatchTowr recorded exploitation attempts against its honeypots using forged administrative tokens. Successful compromise can enable full administrative account takeover and expose API backend endpoints, registered application credentials, consumer keys, and other secrets. Attackers may also be able to intercept data in transit and access internal services reachable through affected API deployments. WSO2 released fixes in April 2026 through community pull requests and subscription update levels; organizations should apply the relevant updates immediately and investigate WSO2 environments for unauthorized administrator tokens or account activity.
Sep 16, 2026
Attackers are actively exploiting critical vulnerabilities in **Cleo Harmony**, **Cleo VLTrader**, and **Cleo LexiCom** managed file transfer software, including `CVE-2024-50623` and the related `CVE-2024-55956`. The flaws affect versions prior to **5.8.0.24** and allow remote, unauthenticated attackers to upload arbitrary files, execute commands, access sensitive data, and alter systems. Security researchers and vendor advisories reported in-the-wild exploitation, with public proof-of-concept exploit code increasing the risk of broad compromise. Intrusions linked to the campaign have been associated with **Clop** data-theft activity, and exploitation was observed from at least early December 2024. Defenders were urged to immediately upgrade affected Cleo products to **5.8.0.24 or later**, restrict external access to exposed file transfer servers, and review logs, autorun locations, and other persistence points for suspicious files or commands. The incident adds Cleo software to the list of heavily targeted file transfer platforms exploited for large-scale enterprise breaches.
Jul 24, 2026
Siemens disclosed **CVE-2026-56451**, a critical authentication-bypass vulnerability in **Opcenter X** caused by improper validation of the algorithm specified in a JSON Web Token (**JWT**) header. The flaw affects **all versions earlier than `V2604`** and allows an **unauthenticated remote attacker** to forge arbitrary JWTs, bypass authentication, impersonate any user including administrators, and potentially obtain full unauthorized access to the application. The issue is classified as **CWE-347** and was assigned a **CVSS v3.1 vector** of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with reporting indicating a **maximum severity score of 10.0** under both CVSS 3.1 and 4.0. Siemens identified **`V2604`** as the remediation release through its ProductCERT advisory, and no active exploitation was reported at disclosure, although the attack class is considered highly exploitable because JWT algorithm confusion techniques are well known and broadly tooled.
Jul 16, 2026