Cleo

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Cleo product.

RSS Feeds for Cleo security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Cleo products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Cleo Sorted by Most Security Vulnerabilities since 2018

Cleo Harmony4 vulnerabilities

Cleo Lexicom4 vulnerabilities

Cleo Vltrader2 vulnerabilities

Cleo Harmomy1 vulnerability

Known Exploited Cleo Vulnerabilities

The following Cleo vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Cleo Multiple Products Unauthenticated File Upload Vulnerability	Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory. CVE-2024-55956 Exploit Probability: 94.0%	December 17, 2024
Cleo Multiple Products Unrestricted File Upload Vulnerability	Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges. CVE-2024-50623 Exploit Probability: 98.6%	December 13, 2024

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 2 vulnerabilities in Cleo with an average score of 6.1 out of ten. Cleo did not have any published security vulnerabilities last year. That is, 2 more vulnerabilities have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	2	6.10
2025	0	0.00
2024	2	9.80
2023	0	0.00
2022	0	0.00
2021	2	7.55

It may take a day or so for new Cleo vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Cleo Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-84115	Sep 01, 2026	Privilege Escalation via JWT Refresh Token Handler in Cleo Harmony 5.8.1.10 (fixed 5.8.1.11) A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component.	Harmony
CVE-2026-84114	Sep 01, 2026	Cleo Harmony 5.8.1.10 SAML Auth Improper Auth via Email Manipulation A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.1.11 is recommended to address this issue. Upgrading the affected component is recommended.	Harmony
CVE-2024-55956	Dec 13, 2024	Cleo Harmony, VLTrader, and LexiCom Remote Code Execution via Autorun Directory In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.	Lexicom Vltrader Harmony And others...
CVE-2024-50623	Oct 28, 2024	Unrestricted File UL/DR in Cleo Harmony, VLTrader, LexiCom <5.8.0.21 (RCE) In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.	Vltrader Harmony Lexicom And others...
CVE-2021-33577	Jun 18, 2021	An issue was discovered in Cleo LexiCom 5.5.0.0 An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and signing of the message) can be bypassed by changing the Content-Type of the message to text/plain.	Lexicom
CVE-2021-33576	Jun 18, 2021	An issue was discovered in Cleo LexiCom 5.5.0.0 An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk.	Lexicom