Cleo Harmony
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Cleo Harmony.
By the Year
In 2026 there have been 2 vulnerabilities in Cleo Harmony with an average score of 6.1 out of ten. Harmony did not have any published security vulnerabilities last year. That is, 2 more vulnerabilities have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2 | 6.10 |
| 2025 | 0 | 0.00 |
| 2024 | 2 | 9.80 |
It may take a day or so for new Harmony vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Cleo Harmony Security Vulnerabilities
Privilege Escalation via JWT Refresh Token Handler in Cleo Harmony 5.8.1.10 (fixed 5.8.1.11)
CVE-2026-84115
6.9 - Medium
- September 01, 2026
A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component.
Improper Privilege Management
Cleo Harmony 5.8.1.10 SAML Auth Improper Auth via Email Manipulation
CVE-2026-84114
5.3 - Medium
- September 01, 2026
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.1.11 is recommended to address this issue. Upgrading the affected component is recommended.
authentification
Cleo Harmony, VLTrader, and LexiCom Remote Code Execution via Autorun Directory
CVE-2024-55956
9.8 - Critical
- December 13, 2024
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
Command Injection
Unrestricted File UL/DR in Cleo Harmony, VLTrader, LexiCom <5.8.0.21 (RCE)
CVE-2024-50623
9.8 - Critical
- October 28, 2024
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
Unrestricted File Upload
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Cleo Harmony or by Cleo? Click the Watch button to subscribe.
