Critical Cleo Harmony Vulnerability Exploited for Privilege Escalation

A newly discovered authentication bypass vulnerability in Cleo Harmony, tracked as CVE-2026-84115, allows remote attackers to escalate privileges by manipulating JWT refresh tokens. The flaw, found in the '/api/connections' function, enables attackers to bypass access controls through crafted HTTP headers. An exploit has been published, increasing the urgency for organizations using Cleo Harmony to patch their systems. Cleo Harmony version 5.8.1.11 addresses this vulnerability, but details on the flaw were not disclosed in the advisory. Security experts warn that the application is a target for ransomware gangs, following previous incidents involving the Cl0p group. Organizations are advised to update their instances immediately to mitigate risks. The vulnerability has a CVSS score of 8.3, indicating a high severity level.

Key Points: • Cleo Harmony vulnerability CVE-2026-84115 allows privilege escalation via JWT manipulation. • An exploit for this vulnerability has been publicly released, increasing the risk for affected organizations. • Cleo Harmony version 5.8.1.11 addresses the vulnerability; immediate updates are recommended.