Critical Privilege Escalation Vulnerability in Cleo Harmony (CVE-2026-84115) Exposes Systems to Remote Exploitation A severe privilege-management vulnerability, tracked as CVE-2026-84115, has been identified in Cleo Harmony versions up to 5.8.1.10, affecting the platform’s JWT Refresh Token Handler and the `/api/connections` endpoint. Disclosed by MITRE on September 1, 2026, and classified by VulDB (VDB-397558) as a CWE-269 (Improper Privilege Management) flaw, the vulnerability carries a CVSS score of 8.3, indicating high severity. The flaw stems from an unknown function in the JWT Refresh Token Handler, where manipulation of the Bearer token argument in HTTP authorization headers can lead to authentication bypass. Attackers exploiting this weakness could escalate privileges, gaining unauthorized administrative access, viewing sensitive data, or disrupting integration workflows managed through Cleo Harmony. The vulnerability is remotely exploitable via network-based HTTP requests, increasing its risk profile particularly as a public exploit has been reported. Successful exploitation could compromise confidentiality, integrity, and availability of systems relying on Cleo Harmony for file transfers and API connectivity. Attackers may intercept legitimate traffic or forge requests using malformed or replayed bearer tokens, potentially enabling lateral movement across connected environments. Remediation requires upgrading to Cleo Harmony version 5.8.1.11 or later, which addresses the privilege-management flaw. While interim measures such as enhanced input validation and bearer token monitoring may reduce exposure, they do not substitute for patching, given the availability of a public exploit. The vulnerability has been assigned an EPSS score of 0.00284, reflecting its exploitability risk.

The Clop ransomware gang exploited a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS), specifically within the BI Publisher Integration component, to conduct data theft attacks since at least August 2025. The flaw allowed unauthenticated remote code execution (RCE) via a single HTTP request, enabling attackers to steal sensitive corporate documents from unpatched systems. Oracle patched the vulnerability in early October 2025, but not before Clop launched an extortion campaign, emailing executives at multiple victim organizations to demand ransoms in exchange for not leaking the stolen data.The attack leveraged a vulnerability chain exposed by leaked proof-of-concept (PoC) exploits from the Scattered Lapsus$ Hunters group, increasing the risk of further exploitation by other threat actors. Clop’s campaign mirrors past high-profile breaches, including MOVEit Transfer (2,770+ organizations affected), Accellion FTA, and GoAnywhere MFT, reinforcing its reputation for large-scale data theft via zero-days. Oracle urged immediate patching, warning that internet-exposed EBS applications remain prime targets. The U.S. State Department has even offered a $10 million reward for intelligence linking Clop to foreign state sponsorship, underscoring the attack’s severity.

The Maine Office of the Attorney General reported that Cleo Communications US, LLC experienced an external system breach (hacking) that began on October 28, 2022, and was discovered on February 8, 2023. Approximately 644 individuals were affected, including one Maine resident, and personal information, including Social Security numbers, may have been exposed. Written notices were sent on April 14, 2023, and credit monitoring and identity restoration services were offered for 24 months.