CVE-2026-84114Disclosure

LOWCVSS 2.1 · LOW

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.1.11 is recommended to address this issue. Upgrading the affected component is recommended.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked at 2 mentions on most recent observed day (2026-09-17)
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

PoC

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-02	1	Disclosure1
2026-09-17	2	Disclosure1PoC1

Full discourse3 posts

Armadin@ArmadinSecurity31d
PoC
From Okta self-registration to full production RCE in Cleo Harmony. By chaining SAML XML Signature Wrapping (XSW) with Cross-Store Identity Confusion, Armadin's red team found a path from zero access to OS command execution. Here’s the full breakdown of CVE-2026-84114 & CVE-2026-84115 🧵👇 1/6 https://www.youtube.com/watch?v=TUv9lKEgbVQ
Post summary
The tweet announces CVE‑2026‑84114 and CVE‑2026‑84115, describing a chained SAML XML Signature Wrapping and identity‑confusion attack that leads to remote code execution, and links to a video that likely demonstrates the PoC.
6401221.3K
986 followersView on X
Armadin@ArmadinSecurity46d
Disclosure
New from our research team --> chaining a SAML Signature Wrapping bug, a forced over-privileged token, and a cross-store identity confusion flaw to take Cleo Harmony from a low-privileged account to remote code execution. Individually minor, critical when chained. CVE-2026-84114 & CVE-2026-84115, fixed in 5.8.1.11. Read more: https://www.armadin.com/blog-posts/compromising-cleo-harmony-a-saml-bypass-chain-to-arbitrary-code-execution
Post summary
The research team exposed a chained vulnerability in Cleo Harmony, enabling remote code execution, and noted the issue has been fixed in version 5.8.1.11.
050113845
941 followersView on X
Armadin@ArmadinSecurity31d
Disclosure
Vuln 1: SAML Signature Wrapping (XSW) [CVE-2026-84114]: Cleo verified a legitimate SAML assertion, but mistakenly consumed an attacker-injected assertion. This bypassed validation and unlocked initial unauthorized access to live support ticket files and customer data. 3/6
Post summary
The text discloses technical details of a SAML Signature Wrapping vulnerability in Cleo, explaining how it bypasses authentication to access support ticket files and customer data, without mentioning patches or exploits.
0001068
553 followersView on X

Explore more

Back to dashboard