Cleo Harmony Flaw Lets Remote Attackers Escalate Privileges via JWT Refresh Token

A newly disclosed vulnerability in Cleo Harmony, a widely deployed managed file transfer and integration platform, is putting enterprise networks at risk after security researchers confirmed that remote attackers can escalate privileges by tampering with the software’s JWT refresh token mechanism.

Tracked as CVE-2026-84115 and rated 8.3 (High) on the CVSS scale, the flaw affects all Cleo Harmony builds up to version 5.8.1.10, and a working public exploit is already circulating, raising the urgency for organizations to act quickly.

The vulnerability lives inside the JWT Refresh Token Handler component, specifically in an unidentified function tied to the /api/connections endpoint. At the heart of the issue is improper handling of the Bearer argument passed in HTTP authorization headers.

By crafting a manipulated Bearer token, an attacker can trick the application into granting elevated permissions that were never intended for their session.

Cleo Harmony Vulnerability

Security analysts classify this weakness under CWE-269, Improper Privilege Management, meaning Cleo Harmony fails to correctly enforce role-based access boundaries when refreshing authentication tokens.

What makes this bug particularly dangerous is its remote exploitability. As documented in the VulDB vulnerability advisory, because the attack works entirely over the network through manipulated HTTP requests, there is no need for local system access, physical proximity, or even valid credentials in some exploitation paths.

Combined with the availability of a public proof-of-concept, defenders now face a realistic threat where opportunistic attackers could scan for exposed Cleo Harmony instances and attempt privilege escalation with minimal effort.

Successful exploitation could hand an attacker administrative-level control over the platform, exposing sensitive file transfer data and giving them the ability to manipulate integration workflows that connect Harmony to other business systems.

From a threat intelligence standpoint, this flaw mirrors token manipulation techniques associated with authentication bypass tactics in the MITRE ATT&CK framework.

Attackers typically intercept, forge, or replay malformed bearer tokens to sidestep the intended refresh-token validation logic, allowing them to maintain persistent access or pivot laterally if Harmony is integrated with other connected environments.

Cleo has already addressed the issue in version 5.8.1.11, which corrects the underlying privilege management logic within the JWT Refresh Token Handler. Organizations running any version at or below 5.8.1.10 should treat this as a priority patch given the public exploit availability.

For teams that cannot upgrade immediately, temporary mitigations include enforcing strict input validation on API requests, deploying WAF rules to inspect and flag suspicious Bearer token patterns, and closely monitoring access logs for anomalous activity targeting the /api/connections endpoint.

Given Cleo’s history of high-impact vulnerabilities, including the actively exploited CVE-2024-50623 file upload flaw from late 2024, security teams should treat this latest disclosure with equal seriousness.

Prompt patching to 5.8.1.11 remains the most reliable way to close this attack window before it is weaponized at scale.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Cleo Harmony Flaw Lets Remote Attackers Escalate Privileges via JWT Refresh Token appeared first on Cyber Security News.