known ransomware use

Cleo Multiple Products Unrestricted File Upload Vulnerability

Added to KEV
2024-12-13
Federal due date
2025-01-03
Vendor
Cleo
Product
Multiple Products
EPSS
99.9th percentile (score 0.940, as of 2026-06-08)
NVD CVSS v3.1
Ransomware use
Known
Upstream
https://nvd.nist.gov/vuln/detail/CVE-2024-50623

CISA short description

Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS percentile is the FIRST.org exploit-probability ranking as of the date noted above; it moves daily. CVSS reflects NVD's analysis at time of publication.