Back Feeds.Feedburner Exploit Published for Fresh Cleo Harmony Vulnerability
Organizations are advised to immediately patch a fresh authentication bypass vulnerability affecting the file transfer application Cleo Harmony.
Tracked as CVE-2026-84115 , the security defect impacts the JWT refresh token logic and allows remote attackers to elevate their privileges via argument bearer manipulation.
The flaw was discovered in an unknown function in the file ‘/api/connections’. An attacker could craft a malicious payload that tampers with the arguments in HTTP headers, bypassing access controls and leading to privilege escalation.
According to VulnDB, an exploit targeting the bug has been released, which significantly increases the risk of exploitation against all organizations that use Cleo Harmony.
“The exploitation strategy typically involves intercepting legitimate traffic or forging new requests where the JWT refresh token logic is bypassed through malformed or replayed bearer tokens,” VulnDB notes .
Attackers could exploit the issue to maintain persistent access, elevate their privileges, or move laterally to other systems that Cleo Harmony integrates with, it says.
The vulnerability was addressed in Cleo Harmony version 5.8.1.11, but Cleo refrained from sharing any details on the security defect in its advisory .
Cleo Harmony customers should update their instances as soon as possible. As attack surface management firm WatchTowr notes, the application is “a favorite ransomware gang target”.
In late 2024, the Cl0p ransomware group exploited a Cleo product vulnerability to steal data from major organizations.
“We’ve already reproduced the vulnerability,” WatchTowr said on Tuesday, urging rapid reaction.
Related: Chrome and Firefox Updates Patch Dozens of Vulnerabilities
Related: SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks
Related: Hackers Start Exploiting Critical Langflow Vulnerability
Related: Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild
Ionut Arghire is an international correspondent for SecurityWeek.
More from Ionut Arghire
Hackers Start Exploiting Critical Langflow Vulnerability
Five Venezuelans Plead Guilty in US Court to ATM Jackpotting
Ransomware Gang Claims Nutex Health Data Breach
9.5 Million Impacted by Aesto Health Data Breach
WatchGuard Patches Critical Vulnerabilities
ServiceNow Patches 3 Critical Code Injection Vulnerabilities
McKesson Confirms Data Breach as Attacker Deadline Looms
Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs
Anthropic Details Response to Security Incidents, Unveils Enterprise Safeguards
Malicious Virtualizor Update Served via BGP Hijacking
OpenAI’s Astra Becomes First Model to Cross Critical Cybersecurity Threshold
Chrome and Firefox Updates Patch Dozens of Vulnerabilities
23-Year-Old Sality P2P Botnet Disrupted
SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks
Palo Alto Networks Acquires AI Agent Platform Console
Sevii Targets AI-Speed Attacks With Preemptive Autonomous Defense
Flipboard Whatsapp Whatsapp Email
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
