Working Exploit Published for Cleo Harmony Flaw That Ransomware Gangs Already Love
A newly discovered flaw in the Cleo Harmony file-transfer application lets attackers break in and take control without a password. A working exploit is already public, and Cl0p used a different Cleo bug to hit major organisations just months ago.
Key points
- CVE-2026-84115, a newly disclosed authentication bypass flaw in Cleo Harmony, lets remote attackers gain elevated access without valid credentials.
- A working exploit for the vulnerability is already publicly available, raising the risk for every organisation still running an unpatched version.
- Cleo Harmony version 5.8.1.11 fixes the flaw; all users should update immediately.
- Security firm WatchTowr, which independently reproduced the vulnerability, describes Cleo Harmony as "a favourite ransomware gang target".
- In late 2024, the Cl0p ransomware group exploited a separate Cleo product flaw to steal data from multiple large organisations.
A fresh security flaw in Cleo Harmony, a business application used to transfer files between companies, has a working exploit online before most organisations have patched it.
Cleo Harmony is specialist software that large companies use to exchange files with suppliers and partners. Purchase orders, invoices, shipping records. It sits at the centre of many supply chains, which is exactly why criminals like it.
What is the vulnerability and how serious is it?
Serious enough to patch today. CVE-2026-84115 is an authentication bypass: attackers can skip the login process entirely and reach the same access level as a legitimate administrator.
The weakness is in how Harmony handles JWT refresh tokens. A JWT, or JSON Web Token, is a small digital pass that software hands to a user after login, confirming identity for future requests. Harmony's refresh logic is flawed: an attacker can manipulate the token passed in HTTP headers, bypass access controls and land with elevated privileges without ever supplying a real password.
From there, they can lock in persistent access, promote their own permissions further, or move into other systems connected to Harmony.
Security database VulnDB confirmed a working exploit has been published. WatchTowr said on Tuesday it had independently reproduced the bug and urged organisations to act fast. Cleo's products are, in WatchTowr's words, "a favorite ransomware gang target".
| Detail | Info |
|---|---|
| CVE ID | CVE-2026-84115 |
| Affected software | Cleo Harmony (all versions before 5.8.1.11) |
| Fixed version | 5.8.1.11 |
| Exploit status | Publicly available |
| Attack type | Authentication bypass, privilege escalation |
Why does the ransomware history matter?
This isn't the first time Cleo has been here. In late 2024, Cl0p, a criminal group that encrypts victims' files and demands multi-million-dollar payments, exploited a different Cleo product flaw to steal data from a string of large organisations. Cl0p's standard playbook is to find widely used file-transfer software, exploit a flaw quietly, and pull data from dozens of victims before anyone reacts. Cleo Harmony sits squarely in that category. Our report on the JFrog Artifactory exploitation from 1 September shows the same pattern playing out across enterprise tooling: a patch lands, attackers move within days.
What should organisations do right now?
Update to Cleo Harmony version 5.8.1.11 immediately. Cleo didn't publish technical details in its advisory, but the fix is confirmed in that release.
IT teams should review access logs for Harmony's /api/connections endpoint, particularly requests involving unusual or repeated authentication headers from unfamiliar addresses.
If your business uses a supplier that runs Cleo Harmony, ask them directly whether they've patched. A breach on their side can expose your data too, and that's a conversation worth having before an incident forces it.
