Cleo Harmony Flaw Lets Remote Attackers Escalate Privileges via JWT Refresh Token

Cybersecuritynews •Guru Baran • September 2, 2026

A newly disclosed vulnerability in Cleo Harmony, a widely deployed managed file transfer and integration platform, is putting enterprise networks at risk after security researchers confirmed that remote attackers can escalate privileges by tampering with the software’s JWT refresh token mechanism. Tracked as CVE-2026-84115 and rated 8.3 (High) on the CVSS scale, the flaw affects […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Cleo Harmony Vulnerability Exploited for Privilege Escalation A newly discovered authentication bypass vulnerability in Cleo Harmony, tracked as CVE-2026-84115, allows remote attackers to escalate privileges by manipulating JWT refresh tokens. The flaw, found in the '/api/connections' function, enables attackers to bypass access controls through crafted HTTP headers. An exploit has been published, increasing the urgency for organizations using Cleo Harmony to patch their systems. Cleo Harmony version 5.8.1.11 addresses this vulnerability, but details on the flaw were not disclosed in the advisory. Security experts warn that the application is a target for ransomware gangs, following previous incidents involving the Cl0p group. Organizations are advised to update their instances immediately to mitigate risks. The vulnerability has a CVSS score of 8.3, indicating a high severity level. 4 sources 73

Extracted Entities

Cleo Harmony Flaw Lets Remote Attackers Escalate Privileges via JWT Refresh Token

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)