EXECUTIVE SUMMARY:
CVE-2026-84115, with a CVSS score of 8.3, is an authentication bypass vulnerability affecting Cleo Harmony, caused by improper handling of JWT refresh tokens that allows remote attackers to manipulate bearer-token arguments and bypass access controls. The flaw resides in the /api/connections endpoint, where crafted HTTP-header payloads can interfere with authentication logic and enable privilege escalation. It is increasing the likelihood of exploitation against exposed Cleo Harmony deployments. Successful exploitation could allow attackers to obtain elevated privileges, maintain persistent access, and potentially move laterally into connected systems. It is advised to apply the available security fix immediately, particularly given the product's history of being targeted by ransomware actors.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-84115, with a CVSS score of 8.3, is an authentication bypass vulnerability affecting Cleo Harmony, caused by improper handling of JWT refresh tokens that allows remote attackers to manipulate bearer-token arguments and bypass access controls. The flaw resides in the /api/connections endpoint, where crafted HTTP-header payloads can interfere with authentication logic and enable privilege escalation. It is increasing the likelihood of exploitation against exposed Cleo Harmony deployments. Successful exploitation could allow attackers to obtain elevated privileges, maintain persistent access, and potentially move laterally into connected systems. It is advised to apply the available security fix immediately, particularly given the product's history of being targeted by ransomware actors.[emaillocker id="1283"]
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://www.securityweek.com/exploit-published-for-fresh-cleo-harmony-vulnerability/
[/emaillocker]