CVE-2026-84115Disclosure

HIGHCVSS 5.5 · MEDIUM

Exploitation observed; activity peaked at 8 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component.

Back to dashboard

7.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-266CWE-269

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 3 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
14 mentions across 5 observed days

What's happening

Active exploitation reported across 3 signals
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 5 signals
Patch or workaround mentioned in 5 signals
Technical details provided in 12 signals
Disclosure: 5 classified signals
General: 2 classified signals
Peaked 3d ago at 8 mentions (2026-09-02); latest day: 2
14 total mentions across 5 days

Deep dive

Activity timeline14 mentions / 5d

Signal classification6 categories

Disclosure

535.7%

General

214.3%

Active Exploitation

214.3%

Exploit

214.3%

PoC

214.3%

Patch

17.1%

Referenced assets10 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-01	1	General1
2026-09-02	8	Active Exploitation1Disclosure2Exploit2General1Patch1PoC1
2026-09-03	2	Active Exploitation1PoC1
2026-09-10	1	Disclosure1
2026-09-17	2	Disclosure2

Full discourse14 posts

watchTowr@watchtowrcyber46d
General
watchTowr is rapidly reacting to CVE-2026-84115 - an auth bypass in Cleo Harmony, a favorite ransomware gang target. We've already reproduced the vulnerability. Active watchTowr Platform clients have been made aware of their exposure - reach out for support. https://t.co/Dr0C0urJaW
Post summary
watchTowr signals that CVE-2026-84115, an authentication bypass in Cleo Harmony, has been reproduced and affected clients notified, but no PoC, exploit, or patch details are supplied.
38219113.4K
12.6K followersView on X
Armadin@ArmadinSecurity30d
Disclosure
From Okta self-registration to full production RCE in Cleo Harmony. By chaining SAML XML Signature Wrapping (XSW) with Cross-Store Identity Confusion, Armadin's red team found a path from zero access to OS command execution. Here’s the full breakdown of CVE-2026-84114 & CVE-2026-84115 🧵👇 1/6 https://www.youtube.com/watch?v=TUv9lKEgbVQ
Post summary
The tweet discloses a vulnerability chain in Cleo Harmony (CVE-2026-84114 & CVE-2026-84115) that allows RCE via SAML XSW and Cross-Store Identity Confusion, with a link to a detailed video breakdown.
6401221.3K
986 followersView on X
Armadin@ArmadinSecurity45d
Disclosure
New from our research team --> chaining a SAML Signature Wrapping bug, a forced over-privileged token, and a cross-store identity confusion flaw to take Cleo Harmony from a low-privileged account to remote code execution. Individually minor, critical when chained. CVE-2026-84114 & CVE-2026-84115, fixed in 5.8.1.11. Read more: https://www.armadin.com/blog-posts/compromising-cleo-harmony-a-saml-bypass-chain-to-arbitrary-code-execution
Post summary
The research team revealed a chain of CVEs in Cleo Harmony that combine a SAML signature wrapping flaw, an over‑privileged token bug, and an identity confusion issue to achieve remote code execution, and the vulnerability has been addressed in version 5.8.1.11.
050113845
941 followersView on X
Total Cyber-Sec@totalcybersec45d
Exploit
🚨 Una falla en #CleoHarmony puede convertir un token manipulado en acceso privilegiado. CVE-2026-84115 ya tiene exploit público y afecta plataformas críticas de transferencia de archivos. 🔗 https://cybersecuritynews.com/cleo-harmony-vulnerability/ 🧵 Hilo #CyberSecurity 👇
Post summary
CVE-2026-84115 in CleoHarmony permits token manipulation to achieve privileged access, with a public exploit already available and impacting critical file‑transfer platforms.
12020294
15.8K followersView on X
yousukezan@yousukezan45d
Exploit
ファイル転送製品Cleo Harmonyに、JWTリフレッシュトークン処理を悪用して認証を回避し、遠隔から権限昇格できる脆弱性「CVE-2026-84115」が見つかった。公開済みエクスプロイトもあり、修正版5.8.1.11が提供されている。問題は/api/connectionsに関連する処理にあり、HTTPヘッダー内のBearer引数を細工することでアクセス制御を回避できるとされる。VulnDBによると、正規通信の傍受や、異常または再利用されたBearerトークンを使う偽造リクエストが想定されている。攻撃者は権限昇格、永続的なアクセス維持、Cleo Harmonyが接続する他システムへの横展開に利用できる可能性がある。Cleoは5.8.1.11で修正したが、アドバイザリでは詳細を公開していない。 WatchTowrは脆弱性を再現したと述べ、迅速な更新を呼びかけている。Cleo製品では2024年末にもCl0pランサムウェア集団が脆弱性を悪用して大規模組織からデータを窃取した事例がある。 https://www.securityweek.com/exploit-published-for-fresh-cleo-harmony-vulnerability/
Post summary
CVE‑2026‑84115 in Cleo Harmony enables JWT Bearer token manipulation for authentication bypass and remote privilege escalation. A publicly available exploit has been published and used by attackers, including the Cl0p ransomware group, and a patch (5.8.1.11) has been released.
010301.4K
16.1K followersView on X
Armadin@ArmadinSecurity30d
Disclosure
Vuln 2: Cross-Store Identity Confusion [CVE-2026-84115]: Armadin then exploited how identity context was mapped across internal data stores. By tricking the system into misinterpreting the forged identity, low-privilege access instantly escalated to full Cleo administration rights. 4/6
Post summary
The text announces CVE-2026-84115, a cross-store identity confusion vulnerability in Cleo that enables privilege escalation, providing technical details without mentioning any exploit code or remediation.
0001075
553 followersView on X
Hephaestvs@Vulcanux_44d
PoC
csirt_it: ‼️ #PoC #Cleo #Harmony: disponibile Proof of Concept (PoC) per la vulnerabilità identificata dalla CVE-2026-84115 Rischio: 🔴 Tipologia: 🔸 Privilege Escalation 🔸 Security Feature Bypass 🔗 https://www.acn.gov.it/portale/w/cleo-harmony-disponibile-poc-per-la-cve-2026-84115 ⚠️ Importante mantenere a… https://t.co/AroTUsdkdp
Post summary
A PoC for CVE-2026-84115 is publicly available, demonstrating privilege escalation and security feature bypass, though no active exploitation or patch information is provided.
0001075
634 followersView on X
Total Cyber-Sec@totalcybersec45d
Disclosure
1/4 🔐 CVE-2026-84115 (CVSS 8.3) afecta el manejo de #JWT Refresh Tokens. Un atacante remoto puede manipular el Bearer token y obtener permisos superiores a los asignados originalmente. #PrivilegeEscalation
Post summary
A new remote privilege escalation vulnerability (CVE‑2026‑84115) involving JWT refresh token manipulation has been disclosed, with a CVSS score of 8.3.
1000063
15.8K followersView on X
Autumn Good@autumn_good_3546d
General
🚨🚨🚨 『The attack is possible to be carried out remotely. The exploit has been made public and could be used.』 CVE-2026-84115 Cleo Harmony https://nvd.nist.gov/vuln/detail/cve-2026-84115
Post summary
The post confirms that CVE-2026-84115 can be leveraged remotely and that the exploit is publicly available, but it lacks detailed technical, patch, or exploitation evidence.
10000456
7.1K followersView on X
iototsecnews@iototsecnews38d
Disclosure
Cleo Harmony の脆弱性 CVE-2026-84115 が FIX：JWT リフレッシュ・トークンを介した深刻な権限昇格 https://iototsecnews.jp/2026/09/02/cleo-harmony-flaw-lets-remote-attackers-escalate-privileges-via-jwt-refresh-token/ 紹介した記事では Cleo Harmony における JWT リフレッシュトークンの不適切な処理に起因する脆弱性 CVE-2026-84115 が解説されています。本製品を未対策のまま運用すると、不正な Bearer トークンを用いるリモート攻撃者が、管理者権限へ昇格するリスクが生じます。この問題による影響は機密ファイル転送データへの不正アクセス／統合ワークフローの操作／他システムへの横展開などです。対応策としては修正済みバージョン 5.8.1.11 への迅速な更新／WAF による疑わしいトークンの検査／アクセスログの監視などが推奨されます。 #Cleo #CVE202684115 #Harmony #Vulnerability
Post summary
The article discloses an improper JWT refresh token handling flaw in Cleo Harmony (CVE‑2026‑84115) that could allow privilege escalation and recommends updating to version 5.8.1.11 along with additional mitigations.
00000146
514 followersView on X
BreachBriefs@BreachBrief45d
Active Exploitation
🚨 Cleo Harmony users: Patch ASAP A fresh authentication bypass vulnerability, CVE-2026-84115, is reportedly being exploited after an exploit was published. The flaw affects JWT refresh-token logic and can enable remote attackers to bypass access controls and escalate privileges. 🔴 Fixed in Cleo Harmony 5.8.1.11 Given Cleo’s history as a ransomware target, organizations should prioritize patching and review logs for suspicious activity. #CVE #Ransomware #InfoSec #ThreatIntel #Vulnerability
Post summary
CVE-2026-84115 is an authentication bypass in Cleo Harmony’s JWT refresh-token logic, actively exploited in the wild and fixed in version 5.8.1.11; rapid patching is advised.
0000080
10 followersView on X
VulDB 🛡@vuldb45d
Active Exploitation
Attention, elevated activities detected targeting Cleo Harmony (CVE-2026-84115) https://vuldb.com/vuln/397558/cti
Post summary
The notice flags detected elevated activity targeting Cleo Harmony for CVE-2026-84115, suggesting active exploitation in the wild, but provides no PoC, patch, or detailed technical information.
00000154
2.3K followersView on X
Cybersecurity News Everyday@TweetThreatNews45d
PoC
Exploit published for a fresh Cleo Harmony flaw, CVE-2026-84115, enabling auth bypass via JWT refresh token manipulation in /api/connections. Attackers may gain elevated access and persistence. #CleoHarmony #CVE-2026-84115 #WatchTowr https://www.hendryadrian.com/exploit-published-for-fresh-cleo-harmony-vulnerability/
Post summary
An exploit for CVE-2026-84115 in Cleo Harmony has been published, demonstrating an authentication bypass via JWT token manipulation, but no active exploitation or patch guidance is mentioned.
00000304
4.7K followersView on X
The Daily Tech Feed@dailytechonx45d
Patch
A severe JWT refresh token bug in Cleo Harmony (CVE-2026-84115) is exposing companies to remote privilege escalation. The breach lives in how the /api/connections endpoint handles Bearer tokens, allowing crafted tokens to gain admin rights. Versions up to 5.8.1.10 are vulnerable; 5.8.1.11 fixes the issue. Teams should update now, enforce strict token validation and monitor logs. #Security #Vulnerability #JWT #PrivilegeEscalation #CleoHarmony #PatchNow https://thedailytechfeed.com/high-severity-jwt-token-flaw-in-cleo-harmony-exposed/
Post summary
The post alerts to a remote privilege escalation flaw in Cleo Harmony (CVE-2026-84115) involving insecure JWT handling, states vulnerable versions up to 5.8.1.10, and urges immediate update to version 5.8.1.11 plus stricter token validation.
0000075
698 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-84115

watchTowr[verified]@watchtowrcyberGeneral

watchTowr signals that CVE-2026-84115, an authentication bypass in Cleo Harmony, has been reproduced and affected clients notified, but no PoC, exploit, or patch details are supplied.

yousukezan[verified]@yousukezanExploit

CVE‑2026‑84115 in Cleo Harmony enables JWT Bearer token manipulation for authentication bypass and remote privilege escalation. A publicly available exploit has been published and used by attackers, including the Cl0p ransomware group, and a patch (5.8.1.11) has been released.

BreachBriefs[verified]@BreachBriefActive Exploitation

CVE-2026-84115 is an authentication bypass in Cleo Harmony’s JWT refresh-token logic, actively exploited in the wild and fixed in version 5.8.1.11; rapid patching is advised.

Cybersecurity News Everyday[verified]@TweetThreatNewsPoC

An exploit for CVE-2026-84115 in Cleo Harmony has been published, demonstrating an authentication bypass via JWT token manipulation, but no active exploitation or patch guidance is mentioned.

The Daily Tech Feed[verified]@dailytechonxPatch

The post alerts to a remote privilege escalation flaw in Cleo Harmony (CVE-2026-84115) involving insecure JWT handling, states vulnerable versions up to 5.8.1.10, and urges immediate update to version 5.8.1.11 plus stricter token validation.

Armadin@ArmadinSecurityDisclosure

The tweet discloses a vulnerability chain in Cleo Harmony (CVE-2026-84114 & CVE-2026-84115) that allows RCE via SAML XSW and Cross-Store Identity Confusion, with a link to a detailed video breakdown.

Armadin@ArmadinSecurityDisclosure

The research team revealed a chain of CVEs in Cleo Harmony that combine a SAML signature wrapping flaw, an over‑privileged token bug, and an identity confusion issue to achieve remote code execution, and the vulnerability has been addressed in version 5.8.1.11.

Total Cyber-Sec@totalcybersecExploit

CVE-2026-84115 in CleoHarmony permits token manipulation to achieve privileged access, with a public exploit already available and impacting critical file‑transfer platforms.