Loading vulnerability…
Cleo Harmony JWT Refresh Token Privilege Escalation
CVE-2026-84115 is an improper privilege-management vulnerability in Cleo Harmony's JWT refresh-token handling. Cleo Harmony versions through 5.8.1.10 improperly process a manipulated Bearer authorization argument during JWT refresh processing, allowing a remote requester to obtain privileges beyond those intended for its session. The issue is reported to have a public proof of concept.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can bypass intended authorization controls and elevate privileges, potentially to administrative-level access in a vulnerable Cleo Harmony deployment. An attacker with elevated access could access managed file-transfer data and modify or interfere with integration workflows and connected business systems.
If you can’t patch tonight, do this now.
Until the upgrade is complete, restrict API access to trusted users and networks, enforce access controls at network boundaries, and monitor authorization and JWT refresh activity for anomalous Bearer-token use or unexpected privilege changes. Apply request-validation and WAF detections where supported.
Patch, then assume compromise.
Upgrade Cleo Harmony to version 5.8.1.11 or later. Version 5.8.1.11 contains the reported correction for this issue.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.