What’s Vulnerable › Vulnerabilities

CVE-2024-55956: Cleo Multiple Products Unauthenticated File Upload Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-12-17
• EPSS: 94.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-12-13 · updated 2026-08-05
• Weakness: CWE-77

Description

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

Affected products

• Cleo Harmony: before 5.8.0.24 — fixed in 5.8.0.24
• Cleo Lexicom: before 5.8.0.24 — fixed in 5.8.0.24
• Cleo Vltrader: before 5.8.0.24 — fixed in 5.8.0.24

How to fix

Upgrade to a fixed version: Cleo Harmony 5.8.0.24; Cleo Lexicom 5.8.0.24; Cleo Vltrader 5.8.0.24. Check the vendor advisory for mitigations.

References

• https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending
• https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update
• https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55956

Get alerted when CVE-2024-55956 or the next vulnerability affects your stack