Cleo Releases Patches for Cleo MFT Zero-day Vulnerability

Arctic Wolf reported a zero-day remote code execution vulnerability in Cleo Managed File Transfer (MFT) products that allowed unauthenticated attackers to import and run arbitrary shell commands by abusing default Autorun directory settings; active exploitation was observed starting 7 December 2024, a proof-of-concept is available, and reports indicate possible use by Termite ransomware. Cleo released fixes in version 5.8.0.24 for Harmony, VLTrader, and Lexicom and recommends immediate patching or removing internet-exposed systems as a temporary mitigation.