Public Exploit for CVE-2026-84115 Puts Cleo Harmony at Immediate Risk

A public exploit for the authentication-bypass vulnerability CVE-2026-84115 in Cleo Harmony has been published, raising the concrete threat to organizations still running versions 5.8.1.0 through 5.8.1.10. On September 2, 2026, the release of attack code — combined with confirmed reproduction by WatchTowr and Cleo's history as a favored target of the Cl0p ransomware gang — makes patching more urgent than ever.

How the Attack Works: JWT Refresh Token Manipulation

The vulnerability resides in the JWT Refresh Token Handler component, exposed through Cleo Harmony's /api/connections endpoint. The attack exploits manipulation of the Bearer argument in the HTTP header to bypass authentication checks, achieving remote privilege escalation.

According to VulnDB, cited by SecurityWeek, the exploitation strategy "typically involves intercepting legitimate traffic or forging new requests where the JWT refresh token logic is bypassed through malformed or replayed Bearer tokens." This mechanism allows a remote attacker to circumvent authentication controls without valid credentials.

The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P, where the E:P flag (Exploit:Proof) confirms the existence of working code. The attack is conducted remotely, requires no pre-existing privileges or user interaction, and impacts confidentiality, integrity, and availability of the system, albeit with local impact on secondary subcomponents.

WatchTowr Confirms: Reproduction and Alarm

Security research firm WatchTowr has reproduced the vulnerability and urged rapid response. Independent confirmation of practical exploitability removes any margin of uncertainty about the threat's severity: the published code works against unpatched instances.

"We've already reproduced the vulnerability"

The same source characterizes Cleo Harmony as "a favorite ransomware gang target," placing the product in a threat context already validated by past exploits. This profiling is not rhetoric: in late 2024, the Cl0p ransomware group exploited a Cleo product vulnerability to steal data, demonstrating that the ecosystem is actively monitored by high-impact operators.

Cleo's Silence: Patch Without Transparency

The vendor released version 5.8.1.11 on May 15, 2026, but the official release notes cite only generic "security-related improvements" without explicitly mentioning CVE-2026-84115 or detailing the corrected mechanism. Cleo justifies this approach with a non-disclosure policy: "For customer protection, Cleo does not disclose all security update details."

While defensible under coordinated disclosure principles, this approach creates an information asymmetry. Attackers who obtain the public exploit possess complete technical intelligence, while enterprise defenders must reconstruct the threat through third-party sources such as VulnDB, WatchTowr, and CVE databases. The absence of a structured vendor advisory slows risk assessment and prioritization of security resources.

The dossier does not document alternative mitigations or temporary workarounds released by Cleo. The source also does not specify whether the vendor directly notified vulnerable enterprise customers or whether the update was distributed through automatic channels.

Immediate Actions

• Update immediately to version 5.8.1.11 all Cleo Harmony instances in the 5.8.1.0–5.8.1.10 range, verifying the build actually running.
• Flag the existence of a public exploit in internal security briefings, prioritizing verification of internet-facing exposure of the /api/connections service.
• Consult VulnDB and WatchTowr analyses for technical intelligence on IoCs and traffic patterns associated with Bearer token manipulation, given the absence of details in the official channel.
• Reconstruct access history to Cleo Harmony from the release of version 5.8.1.0, with particular attention to anomalous requests to the /api/connections endpoint that may indicate authentication-bypass attempts.

Why the Cl0p History Matters

The late-2024 precedent is not a narrative flourish. Cl0p demonstrated that vulnerabilities in Cleo produce compromises with data exfiltration, not just unauthorized access. WatchTowr's confirmed reproduction, combined with the public exploit, drastically lowers the barrier to entry for ransomware operators who can replicate the already-proven attack chain.

The dossier does not confirm active exploitation at the time of publication, nor does it identify the original vulnerability researcher. The number of organizations actually exposed remains unknown. These limits do not attenuate the urgency: the conjunction of proof-of-concept exploit, independent reproduction, and the target's historical profile constitutes a risk triangle sufficient to justify immediate action.

Frequently Asked Questions

Is Cleo Harmony typically exposed to the internet?

The dossier does not specify the actual attack surface. Cleo Harmony is a managed file transfer platform; many enterprise implementations are accessible from external networks for data exchange with partners. Exposure assessment is the responsibility of each organization.

Why does the CVSS not report an aggregate numeric score?

Sources provide the full CVSS 4.0 vector but do not state a synthetic numeric score. Per calibration rules, we do not publish scores not explicitly declared by sources.

Does the May 15, 2026 fix resolve other vulnerabilities?

Official release notes cite "security-related improvements" in the plural, but do not detail how many or which ones. The dossier does not document additional CVEs fixed in the same release.

Sources

• https://www.securityweek.com/exploit-published-for-fresh-cleo-harmony-vulnerability/
• https://radar.offseq.com/threat/exploit-published-for-fresh-cleo-harmony-vulnerability-71a7c1a9a22869f9
• https://radar.offseq.com/threat/cve-2026-84115-improper-privilege-management-in-cleo-harmony-9d5ce250ea59f7c1
• https://nvd.nist.gov/vuln/detail/cve-2026-84115
• https://support.cleo.com/hc/en-us/articles/30258468834583-Cleo-Harmony-5-8-1-Release-Notes#Version58111
• https://podcast.securityweek.com/
• https://www.securityweek.com/wp-content/uploads/2022/01/SecurityWeek_Dark_News.png