---
id: "CVE-2024-50623"
kind: "vulnerability"
aliases: ["CVE-2024-50623"]
title: "In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Cleo Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "cleo harmony", "fixed": ["5.8.0.21"], "affected": "< 5.8.0.21", "ecosystem": "vendor"}, {"name": "cleo lexicom", "fixed": ["5.8.0.21"], "affected": "< 5.8.0.21", "ecosystem": "vendor"}, {"name": "cleo vltrader", "fixed": ["5.8.0.21"], "affected": "< 5.8.0.21", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cleo", "exploited", "managed-file-transfer", "ransomware", "self-hosted", "vendor"]
not_affected_if: ["product-not-deployed"]
published_at: "2024-10-28T00:15:03+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50623", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted…

Cleo Harmony, VLTrader, and LexiCom are managed file transfer products with an unrestricted file upload and download flaw. An attacker can upload and retrieve files to reach remote code execution with elevated privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cleo Multiple Products affected ? fixed ?
- vendor:cleo harmony affected < 5.8.0.21 fixed 5.8.0.21
- vendor:cleo lexicom affected < 5.8.0.21 fixed 5.8.0.21
- vendor:cleo vltrader affected < 5.8.0.21 fixed 5.8.0.21

## How to check

Identify whether Cleo Harmony, VLTrader, or LexiCom is deployed in your environment; the sources do not give a file, command, or setting to check.

## Fix

Apply the vendor mitigations from Cleo, or discontinue use of the affected product if mitigations are unavailable, per CISA's required action. Specific fixed versions: unknown

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-50623
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-50623

## From the sources

Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_