VulDB's CVE record for CVE-2026-84115, published on 1 September 2026 (11:00 pm Perth), says a vulnerability was found in Cleo Harmony up to 5.8.1.10, in an unknown function of the file /api/connections of the JWT Refresh Token Handler component: manipulating the Bearer argument results in improper privilege management, the attack can be carried out remotely, and the exploit has been made public and could be used.

The record lists Harmony 5.8.1.0 to 5.8.1.10 as affected and says upgrading to version 5.8.1.11 is sufficient to fix the issue. VulDB scores it CVSS 3.1 8.3 (High) and CVSS 4.0 6.9 (Medium). (source: CVE-2026-84115 record, CNA VulDB)

Correction (1 Nov 2026): removed the SecurityWeek link and credit, which this desk cannot read, and the details that came only from SecurityWeek, Cyber Security News or Cleo's Harmony 5.8.1 release notes, which did not load for the desk this pass (watchTowr's comments, the release-note build description and the remark about vendor detail); the CVSS scores now come from VulDB's CVE record. The card date stays 1 September 2026, the record's publication date. (source: CVE-2026-84115 record)