SecAlerts
c

cleo

Security Risk Profile

52
/100
medium

Security Risk Score

Comprehensive risk assessment based on 10 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from June 18, 2021 to present

10
Total CVEs
3
Critical+High
5
Exploited
3
Unpatched

Threat Assessment

Avg CVSS
7.1
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
3
Critical/High
Risk Level
52/100
medium
⚠️ 5 Active Exploits 6 Zero-Days🆕 2Fresh (<7d)📈 2 in Last 30 Days

Severity Distribution

Critical
3
High
0
Medium
2
Low
1

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
0

Age Distribution

Common Weaknesses (CWE)

1
Command Injection
1
2
Malicious File Upload
1
3
Path Traversal
1

Most Affected Products

1. Cleo Harmony6
2. Cleo LexiCom3
3. Cleo Multiple Products2
4. Cleo Lexicom2
5. Cleo Vltrader2

Recent Vulnerabilities

See more →
CVE-2026-84115
CVSS 5.5medium

Cleo Harmony JWT Refresh Token connections privileges management

Sep 1, 2026🔧 No Patch
CVE-2026-84114
CVSS 2.1low

Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication

Sep 1, 2026🔧 No Patch
https://www.bleepingcomputer.com/news/security/ascension-discloses-new-data-breach-after-third-party-hacking-incident/
unknown

Ascension discloses new data breach after third-party hacking incident

Apr 30, 2025⚡ Zero-Day🔧 No Patch
https://www.bleepingcomputer.com/news/security/retail-giant-sams-club-investigates-clop-ransomware-breach-claims/
unknown

Retail giant Sam’s Club investigates Clop ransomware breach claims

Mar 28, 2025⚠ Exploited⚡ Zero-Day🔧 No Patch
https://www.bleepingcomputer.com/news/security/western-alliance-bank-notifies-21-899-customers-of-data-breach/
unknown

Western Alliance Bank notifies 21,899 customers of data breach

Mar 18, 2025⚠ Exploited⚡ Zero-Day🔧 No Patch
https://www.theregister.com/2025/02/28/cisa_kev_list_ransomware/
unknown

CISA's KEV list informs ransomware attacks, paper suggests

Feb 28, 2025⚠ Exploited⚡ Zero-Day🔧 No Patch
CVE-2024-55956
CVSS 9.8critical

Cleo Multiple Products Unauthenticated File Upload Vulnerability

Dec 13, 2024⚠ Exploited⚡ Zero-Day🔧 No Patch
CVE-2024-50623
CVSS 9.8critical

Cleo Multiple Products Unrestricted File Upload Vulnerability

Oct 27, 2024⚠ Exploited⚡ Zero-Day🔧 No Patch
CVE-2021-33577
CVSS 5.3medium
Jun 18, 2021🔧 No Patch
CVE-2021-33576
CVSS 9.8critical
Jun 18, 2021🔧 No Patch

Monitor cleo in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

cleo Security Vulnerabilities & Risk Score | 10 CVEs | SecAlerts - SecAlerts