Cleo Software Actively Being Exploited in the Wild CVE-2024-55956 | Huntress

Huntress warns of active exploitation against Cleo LexiCom, VLTrader, and Harmony (<= 5.8.0.21) via an arbitrary file-write vulnerability that allows autorun processing to execute encoded PowerShell and fetch JAR-based webshells for persistence; the vendor patch 5.8.0.21 was shown to be insufficient, multiple victims were observed, and Huntress published IOCs and mitigations.