https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Cleo.Sun, 26 Jul 2026 22:32:52 GMThttps://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701cst-561Researchers discovered and chained two vulnerabilities in Progress ShareFile's Storage Zone Controller (an on-premises gateway managing file transfers) to achieve unauthenticated remote code execution. The flaws, CVE-2026-2699 (authentication bypass) and CVE-2026-2701 (remote code execution), affected version 5.12.3 on the ASP.NET branch and were patched in version 5.12.4 released March 10, 2026. Approximately 30,000 Storage Zone Controller instances are exposed on the internet.Thu, 02 Apr 2026 10:00:42 GMThttps://huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wildcst-901Huntress has detected active exploitation of three Cleo file transfer management products (LexiCom, VLTransfer, and Harmony) in the wild, tracked as CVE-2024-55956. The vulnerability is being actively exploited against organizations using these widely deployed solutions.Mon, 06 Jan 2025 21:16:42 GMThttps://huntress.com/blog/cleo-software-vulnerability-malware-analysiscst-908Huntress security researchers have analyzed CVE-2024-55956, a vulnerability in Cleo software, and documented a new malware family they named Malichus. The analysis provides technical details on how the vulnerability is being exploited in the wild.Wed, 11 Dec 2024 00:00:00 GMT