CVE-2024-55956
CISA KEV RANSOMWARE
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
CISA Known Exploited Vulnerability
Vendor / Product
Cleo — Multiple Products
Date Added
2024-12-17
Remediation Due
2025-01-07
Ransomware Use
CONFIRMED
https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956 ; https://nvd.nist.gov/vuln/detail/CVE-2024-55956
Weakness Classification (1)
Affected Software (3)
References & Advisories (4)
Vendor Advisory
Vendor Advisory
US Government Resource
Exploit
Third Party Advisory