Cleo file transfer zero-days exploited by Clop for data theft
Cleo Multiple Products
Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.
Why this severity: CVSS 9.8 (v3.1, CISA-ADP), actively exploited (CISA KEV); known ransomware use
- Started
- Dec 3, 2024
- Closed
- Dec 17, 2024
Affected
- Cleo Harmony, VLTrader and LexiCom before 5.8.0.24 (Cleo)
Fixed in
- 5.8.0.24 (Cleo, for CVE-2024-55956)
- 5.8.0.21 (Cleo, for CVE-2024-50623)
Updates by day8
▸Dec 17, 2024
Link #CISA added CVE-2024-55956 to the KEV catalog (federal deadline 2025-01-07)
Source
▸Dec 16, 2024
Link #Clop claims responsibility for the Cleo data-theft attacks
Source
▸Dec 14, 2024
Link #Cleo advisory: patch 5.8.0.24 for CVE-2024-55956
Source
▸Dec 13, 2024
Link #▸Dec 9, 2024
Link #Huntress warns that fully patched 5.8.0.21 systems are still exploitable
Source
▸Dec 3, 2024
Link #Earliest exploitation Huntress observed against Cleo servers
Source
▸Oct 27, 2024
Link #CVE-2024-50623 published
Source
Advisories5
News & write-ups2
Notes & caveats
Derived from the CISA KEV JSON feed (catalogVersion 2026.10.21); CVSS from the CVE record (cveawg.mitre.org). startedAt is the CVE publication date when it fell in 2024 before the KEV listing, else the KEV dateAdded; exploitation may have begun earlier. closedAt is the KEV listing date (a fix or mitigation was available then unless noted).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
