{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "cleo",
    "label": "Cleo",
    "isStack": false,
    "url": "https://pwn.watch/t/cleo",
    "feed": "https://pwn.watch/t/cleo/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "title": "Cleo file transfer zero-days exploited by Clop for data theft",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "json": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Cleo Multiple Products",
      "tags": [
        "cleo",
        "zero-day",
        "cl0p",
        "file-transfer",
        "data-breach",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-50623",
        "CVE-2024-55956"
      ],
      "affectedVersions": [
        "Cleo Harmony, VLTrader and LexiCom before 5.8.0.24 (Cleo)"
      ],
      "fixedVersions": [
        "5.8.0.24 (Cleo, for CVE-2024-55956)",
        "5.8.0.21 (Cleo, for CVE-2024-50623)"
      ],
      "startedAt": "2024-12-03",
      "closedAt": "2024-12-17",
      "updatedAt": "2024-12-17",
      "summary": "Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-17",
      "title": "CISA added CVE-2024-55956 to the KEV catalog (federal deadline 2025-01-07)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-16",
      "title": "Clop claims responsibility for the Cleo data-theft attacks",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-responsibility-for-cleo-data-theft-attacks/",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-14",
      "title": "Cleo advisory: patch 5.8.0.24 for CVE-2024-55956",
      "body": null,
      "sourceUrl": "https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-13",
      "title": "CVE-2024-55956 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-55956",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-13",
      "title": "CISA added CVE-2024-50623 to the KEV catalog (federal deadline 2025-01-03)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-09",
      "title": "Huntress warns that fully patched 5.8.0.21 systems are still exploitable",
      "body": null,
      "sourceUrl": "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-03",
      "title": "Earliest exploitation Huntress observed against Cleo servers",
      "body": null,
      "sourceUrl": "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    },
    {
      "incident": "cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956",
      "incidentTitle": "Cleo file transfer zero-days exploited by Clop for data theft",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-27",
      "title": "CVE-2024-50623 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-50623",
      "url": "https://pwn.watch/i/cleo-harmony-vltrader-lexicom-zero-days-cve-2024-50623-55956"
    }
  ]
}