Cleo Releases Patch for Critical Harmony EDI Flaw

A new authentication-bypass flaw in Cleo Harmony went public on September 1, 2026, and unlike most disclosures this one shipped with a working exploit attached. Tracked as CVE-2026-84115, the bug lets a remote attacker manipulate JWT bearer tokens to gain privileges they were never granted, and SecurityWeek reported that organizations are advised to immediately patch a fresh authentication bypass vulnerability affecting the file transfer application Cleo Harmony, tracked as CVE-2026-84115, impacting the JWT refresh token logic and allowing remote attackers to elevate their privileges via argument bearer manipulation. If you run Harmony, VLTrader, or LexiCom as your AS2 or SFTP trading-partner gateway, this is not a bug you file for next sprint.

What exactly is broken

The vulnerability has been identified in Cleo Harmony versions up to 5.8.1.10, affecting the platform's JWT Refresh Token Handler and the /api/connections endpoint, disclosed by MITRE on September 1, 2026, and classified by VulDB (VDB-397558) as a CWE-269 (Improper Privilege Management) flaw, carrying a CVSS score of 8.3. The mechanics are specific: the security defect impacts the JWT refresh token logic and allows remote attackers to elevate their privileges via argument bearer manipulation, discovered in an unknown function in the file '/api/connections,' where an attacker could craft a malicious payload that tampers with the arguments in HTTP headers, bypassing access controls and leading to privilege escalation.

WatchTowr, the attack surface management firm that reproduced the exploit, described how it actually gets used in the wild: "the exploitation strategy typically involves intercepting legitimate traffic or forging new requests where the JWT refresh token logic is bypassed through malformed or replayed bearer tokens." That's not a theoretical CVSS number. Attackers can maintain persistent access and pivot from there, and could exploit the issue to maintain persistent access, elevate their privileges, or move laterally to other systems that Cleo Harmony integrates with.

What to do, and by when

There's no grace period here given the public exploit. Cleo already shipped the fix, but didn't say much about it: the vulnerability was addressed in Cleo Harmony version 5.8.1.11, but Cleo refrained from sharing any details on the security defect in its advisory.

Concretely, this week's action list looks like:

• Inventory every Cleo Harmony, VLTrader, and LexiCom instance across your environment and confirm the exact version string, not just what change management thinks is deployed.
• Patch to 5.8.1.11 or later immediately. Cleo Harmony customers should update their instances as soon as possible.
• Rotate JWT signing secrets and any long-lived API credentials tied to /api/connections, since a stolen or forged bearer token from before the patch may still be valid.
• Pull connection logs and look for anomalous bearer token reuse, unexpected admin-level API calls, or authentication events outside your normal partner traffic windows.
• Restrict management and API endpoints to trusted IP ranges or a VPN rather than leaving them internet-facing by default.

Why this hits EDI operations differently than a generic IT patch

Cleo Harmony isn't a file share. It's the box that terminates AS2 connections with your trading partners, translates and routes 850s, 810s, and 856s, and holds the mapping configurations and partner credentials that make those exchanges work. A privilege escalation here doesn't just risk file theft. Someone with elevated access inside Harmony can view or alter documents mid-route, impersonate a trading partner connection, or quietly reconfigure a mapping so an 856 ships with the wrong data and nobody notices until a chargeback shows up. Cleo Harmony handles vast amounts of critical business data, and for supply chain teams that data is purchase orders, invoices, and shipment confirmations feeding directly into ERP.

This isn't Cleo's first rodeo, and that's the part to remember

Cleo's MFT products have been a live ransomware target before. In December 2024, Cleo, which has over 4,200 customers across the world, issued an advisory (CVE-2024-55956), warning of a separate "unauthenticated malicious hosts vulnerability that could lead to remote code execution." Huntress found mass exploitation was occurring, at least ten businesses had been compromised, and even fully patched systems were exploitable, and the Cl0p ransomware group later took credit for exploitation of the Cleo product vulnerability tracked as CVE-2024-55956. The lesson from that incident applies again now: patch, then verify the patch actually closed the hole rather than assuming version number alone means you're safe. WatchTowr's own confirmation that it "already reproduced the vulnerability" is exactly the kind of independent check your team should be running against your own patched instance before declaring victory.

The pattern behind the pattern

As attack surface management firm WatchTowr notes, the application is "a favorite ransomware gang target," and in late 2024, the Cl0p ransomware group exploited a Cleo product vulnerability to steal data from major organizations. Cleo isn't alone in this category. GoAnywhere, MOVEit, and IBM Sterling File Gateway have each had their own moment as the entry point of choice for extortion groups, because on-prem MFT software sits exactly where you'd want it if you were an attacker: internet-facing, trusted by every partner connection, and rarely monitored as closely as the ERP it feeds. It's part of why some shippers and manufacturers are shifting partner- and carrier-facing document exchange off self-hosted MFT boxes entirely, toward platforms like Cargoson, project44, or FourKites that manage the AS2 and API endpoints on their own infrastructure instead of exposing yours.

Next steps

If you haven't confirmed your Harmony version today, stop reading and go check. The exploit is public, the fix is a version bump to 5.8.1.11, and the cost of waiting is measured in the same currency as December 2024: stolen trading-partner data and a very uncomfortable disclosure call.