CVE-2024-50623: Cleo Harmony, VLTrader & LexiCom unrestricted file upload RCE, ransomware-exploited
The short version: Cleo's managed-file-transfer products — Harmony, VLTrader, and LexiCom — have an unrestricted file-upload-and-download flaw (CVE-2024-50623) that lets an unauthenticated attacker place a file and get it executed, yielding remote code execution with elevated privileges. It scores 9.8, it was exploited at scale by ransomware operators, and it's in CISA's KEV catalog. Note carefully: the first patch was found insufficient — make sure you're on a fully fixed build. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 98.53% · 99.92th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-01-03 |
| Known exploited? | Yes — mass exploitation, including ransomware campaigns |
| Vulnerability type | CWE-434 unrestricted file upload → remote code execution with elevated privileges |
| Requires authenticated session? | No — pre-authentication |
| Affected | Cleo Harmony, VLTrader, and LexiCom before 5.8.0.21 |
| Fixed in | 5.8.0.21 — but the initial fix was found insufficient; apply Cleo's follow-up guidance (see advisory) |
What you need to know
CVE-2024-50623 is an unrestricted file upload and download flaw. Cleo's file-transfer products let an unauthenticated attacker write a file to the server and retrieve/execute it, and that turns into remote code execution with elevated privileges on the host.
This one is a textbook case of why exposure ranking matters:
- They're internet-facing by design. Managed-file-transfer (MFT) servers exist to exchange files with outside partners, so they sit on the perimeter — exactly where an attacker wants them.
- It was exploited at scale. Ransomware operators used this against MFT deployments; CISA flagged it as a known ransomware vulnerability.
- The first fix wasn't enough. Cleo's initial 5.8.0.21 patch was found to be bypassable, and a follow-up fix was required — patching to "a" version isn't the same as patching to a complete one.
How serious we see it
High — the 9.8 holds, and history backs it.
Unauthenticated code execution on an internet-facing file-transfer server, weaponized by ransomware crews against real organizations, is as urgent as external exposure gets. The catch that sets this apart from a routine "patch and move on" is the incomplete first fix: teams that patched early may still be exposed. The reassuring part is that it's specific and fixable — known products, a defined version, and clear vendor guidance — but you have to confirm you're on the fully remediated build, not just the first one.
Recommendations
Straight from Cleo's advisory and CISA:
- Patch to the fully-fixed build. Upgrade Harmony/VLTrader/LexiCom per Cleo's current guidance — the initial 5.8.0.21 release was found insufficient, so verify you're on a complete fix.
- Assume compromise given the mass exploitation — hunt. Follow Cleo's IoC guidance; review the autorun/host directories and logs for planted files and unexpected process execution.
- If you find indicators, respond fully. Isolate the server, rotate credentials and keys, and investigate for ransomware staging and lateral movement.
- Harden exposure. Restrict which partners and IPs can reach the MFT server; keep the management surface off the public internet.
- Confirm your exposure first. Verify whether you run an affected Cleo product reachable from the internet.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing Cleo MFT servers, fingerprints the product and version, and flags exposure tied to KEV-listed, ransomware-exploited vulnerabilities like this one — pushed to the top of your results because it's in KEV and because the real-world impact is severe.
That continuous, attacker's-eye view is exactly what you want for perimeter file-transfer servers, where the internet-facing exposure is the whole point of the product: the affected appliance is already mapped, so you can go straight to patch-and-verify.