Historical catalog analysis: CISA added this entry on December 17, 2024. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2024-55956 is an unrestricted file upload vulnerability (CWE-276) identified in several managed file transfer (MFT) products from Cleo. The flaw allows an unauthenticated attacker to import and execute arbitrary bash or PowerShell commands on the host system. This execution path leverages the default settings of the Autorun directory within the affected software.
Exposure and applicability
This vulnerability applies to organizations utilizing the following Cleo products:
* Cleo Harmony
* VLTrader
* LexiCom
Exposure is high for these assets because the attack vector does not require authentication. The ability to execute system-level commands (bash or PowerShell) suggests that an attacker who can reach the MFT interface may gain significant control over the underlying host operating system. This vulnerability has been noted as having known use in ransomware campaigns.
Remediation priorities
Based on the reported risk, our analysis suggests the following prioritization for vulnerability management teams:
- Immediate Asset Identification: Locate all instances of Cleo Harmony, VLTrader, and LexiCom across the environment, specifically those with external-facing interfaces.
- Vendor Mitigation Deployment: Apply the specific mitigations provided by the vendor. If the vendor has not provided a mitigation for a specific version in use, our analysis suggests evaluating whether to discontinue use of the product until a fix is available.
- Network Segmentation: As a compensating control to limit potential damage, restrict network access to these MFT products to known, authorized IP addresses to reduce the surface area available to unauthenticated attackers.
How to validate remediation
Verification must go beyond a simple version check. To ensure exposure is reduced, defenders should:
* Confirm Mitigation Application: Verify that the specific configuration changes or patches mandated by the vendor instructions have been applied and are active on the host.
* Verify Autorun Restrictions: Confirm that the default settings of the Autorun directory have been modified according to the vendor’s security update to prevent unauthenticated file imports from triggering command execution.
Limits and open questions
While applying vendor mitigations addresses the known exploit path, residual risk remains if other unauthenticated entry points exist within the MFT suite. It is currently unknown if there are alternative methods to trigger the Autorun directory or similar functionality outside of the specific path described in CVE-2024-55956. Furthermore, because this vulnerability has been linked to ransomware campaigns, organizations should assume that any system where this vulnerability existed may require a deeper forensic review for indicators of compromise.
Source and editorial note
CVE-2024-55956: Cleo Multiple Products Unauthenticated File Upload Vulnerability · Source date: December 17, 2024 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: December 20, 2024. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 31, 2026 at 00:31 UTC.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗