Vulnerabilities · 55 days ago

Cleo Harmony PoC shrinks the fix window

CSIRT Italia said a public proof of concept is now available for CVE-2026-84115 in Cleo Harmony, turning a fixed privilege-escalation bug into an immediately usable attack path for instances still below 5.8.1.11. The flaw affects the JWT refresh-token logic behind the /api/connections endpoint.

An attacker can send a specially shaped refresh request and manipulate the Bearer value so the server accepts a request it should reject, then grants higher access. In plain terms, the app trusts a bad token-refresh exchange enough to hand over more privilege, so an initial remote reach can become authenticated control.

For operators, the exposure sits in the authentication layer of a file-transfer platform that often connects into other systems, so the practical blast radius is whatever data and controls that API can reach. The new PoC does not change the bug’s scope, but it does change the timing: unpatched systems are now usable targets, not just theoretical ones.

CVE-2026-84115

NVD KEV

CVSS 8.3 HIGH: a vulnerability was found in Cleo Harmony up to 5.8.1.10. EPSS 0.5% (38th percentile).

Timeline

Sep 3 Reported by CSIRT Italia / ACN
Sep 2 Reported by SecurityWeek

Sources

2 sources covering this story

CSIRT Italia / ACN Sep 3
Cleo Harmony: disponibile PoC per la CVE-2026-84115
Disponibili Proof of Concept (PoC) per lo sfruttamento delle CVE-2026-84114 e CVE-2026-84115 – già sanate dal vendor – presenti in Cleo Harmony.
SecurityWeek Sep 2
Exploit Published for Fresh Cleo Harmony Vulnerability
The security defect allows remote attackers to bypass authentication through argument bearer manipulation.

Entities

CVE-2026-84115

Part of the PlainSec briefing for 2026-09-04

Editions

Vulnerabilities · 55 days agoCleo Harmony PoC shrinks the fix windowCSIRT Italia said a public proof of concept is now available for CVE-2026-84115 in Cleo Harmony, turning a fixed privilege-escalation bug into an immediately usable attack path for instances still below 5.8.1.11. The flaw affects the JWT refresh-token logic behind the /api/connections endpoint.An attacker can send a specially shaped refresh request and manipulate the Bearer value so the server accepts a request it should reject, then grants higher access. In plain terms, the app trusts a bad token-refresh exchange enough to hand over more privilege, so an initial remote reach can become authenticated control.For operators, the exposure sits in the authentication layer of a file-transfer platform that often connects into other systems, so the practical blast radius is whatever data and controls that API can reach. The new PoC does not change the bug’s scope, but it does change the timing: unpatched systems are now usable targets, not just theoretical ones.