Cleo patched the file. They did not patch the Autorun directory the file dropped into.

Most patches close the row when the function the bug lived in stops accepting the input the bug exploited. The change record names the build, the SI-2 narrative names the change record, the QSA reads the narrative, the audit form rolls up. For a class of bugs the model works. For Cleo it did not work for six weeks, and the part of the product that broke the model is not the function the patch landed in. It is the Autorun directory the function’s output went to.

<install>\autorun\ is a documented administrative feature on Cleo Harmony, VLTrader, and LexiCom. The product ships with the directory created on install. The product ships with the watcher running. The watcher polls the directory and processes whatever lands there — for XMLs, run the embedded commands; for ZIPs, unpack and execute the inner payloads. The feature is intended for operator-driven automation: drop a file, the product picks it up. The feature is ambient. The CVE-2024-50623 file-write primitive landed bytes in the directory and the watcher executed them as the service account. PowerShell, base64-encoded payload, code execution. The bug was the write. The RCE was the watcher.

The October patch added a validatePath() function to the Retrieve and ADD handlers. The intent was to block path- traversal writes that landed in the Autorun directory from non-Autorun handlers. The implementation was bypassable; Huntress published a working bypass against 5.8.0.21 on December 9 after notifying Cleo on December 3. Whether CVE-2024-55956 is technically a bypass of validatePath() or a separate CWE-77 issue in the Autorun feature itself is a question researchers disagreed on; Huntress and Darktrace call it a bypass, Rapid7 calls it a distinct bug. The operational answer is the same either way. 5.8.0.21 was bypassable. The Autorun directory was the reason the bypass mattered.

The 5.8.0.24 build that closed both bug paths shipped December 11 or 12 and changed the Autorun behavior. The interim mitigation Cleo recommended between the second incident and the 5.8.0.24 build was to clear the Autorun Directory field in Configure → Options → Other — an emergency disable of a documented product feature, against a default-enabled directory, in the middle of an active Cl0p campaign. That is the architectural critique in operator terms. The October patch was a check on a function. The December patch was a change to the product. The two patches were necessary against the same CVE row. The audit form had one cell.

The wider pattern is the one the Cleo blog post named. Five MFT vendors in five years have been mass-exploited by Cl0p on substantially the same playbook. Accellion FTA in 2020, Serv-U in 2021, GoAnywhere and MOVEit in 2023, Cleo in 2024. The bug classes vary — SQL injection, deserialization, command injection, file write — and the patches in each case landed on the immediate function. The admin UI on the same listener as the data plane, the legacy codebase with no full-time security engineering, the reactive disclosure, the fix that closes one path against an architecture that ships the next path are constant across the five vendors. Calling Cleo a Cleo problem misreads the record. The patch-the-function-not-the-product pattern is the structural shape of the MFT tier and the audit framework writes against the function-level change.

The narrow operational instruction is short. Hosts that ran 5.8.0.21 between approximately December 3, 2024 and the day the operator applied 5.8.0.24 should be treated as compromised; the IR work includes log preservation to write-protected storage before reboot, the Huntress IoC list against <install>\autorun\ and <install>\hosts\, and a blast-radius map across every trading partner whose data flowed through the appliance. The wider instruction is one the editorial corpus keeps arriving at and the audit form cannot directly encode. The patch the vendor advisory names is the function. The architecture the function lives in is the part the next campaign will read from. The QSA reading the audit narrative sees the change record close the cell. The operator reading the change record sees a build number. The adversary reading the product sees a watcher polling a directory. The three reads do not disagree about what the patch did. They disagree about what the patch was supposed to do, and the form has no field for the disagreement.