Actively exploited in the wild
Cleo Multiple Products Unauthenticated File Upload Vulnerability
Cleo - Multiple Products · Listed in the CISA KEV since 2024-12-17. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-55956
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
In Cleo Harmony, VLTrader, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
Risk Assessment
An attacker without authentication can take control of the system, leading to full compromise and potential data loss.
Recommendation
Update Cleo software to version 5.8.0.24 or later and review the Autorun directory configuration.
Other vulnerabilities in Cleo Harmony
See all- CVE-2026-84115High
A vulnerability in Cleo Harmony up to version 5.8.1.10 affects an unknown function in the /api/connections file of the JWT Refresh Token Handler component. Manipulation of the Bearer argument leads to improper privilege management. The attack can be carried out remotely, and the exploit has been made public.
- CVE-2026-84114Medium
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.1.11 is recommended to address this issue. Upgrading the affected component is recommended.
Original NVD description (English source)
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.