CVE-2026-84114
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.1.11 is recommended to address this issue. Upgrading the affected component is recommended.
Risk Assessment
Risk of unauthorized system access through authentication bypass, potentially leading to security breaches and account takeover.
Recommendation
Upgrade Cleo Harmony to version 5.8.1.11 or later. Additionally, review SAML configuration and monitor authentication logs.
Other vulnerabilities in Cleo Harmony
See all- CVE-2024-55956CriticalActively exploited
In Cleo Harmony, VLTrader, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
- CVE-2026-84115High
A vulnerability in Cleo Harmony up to version 5.8.1.10 affects an unknown function in the /api/connections file of the JWT Refresh Token Handler component. Manipulation of the Bearer argument leads to improper privilege management. The attack can be carried out remotely, and the exploit has been made public.
Original NVD description (English source)
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.1.11 is recommended to address this issue. Upgrading the affected component is recommended.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS