Cleo

Global cloud / infrastructure

Aliases / services: Cleo / Cleo Communications US LLC / Cleo Communications US, LLC / Cleo Communications Inc / Cleo Harmony / Cleo VLTrader / Cleo LexiCom / Cleo Clarify / Cleo Dashboards / Cleo VLProxy / Cleo Integration Cloud / Cleo WebEDI / EXTOL
Official website: https://www.cleo.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Listed services and systems

Response status: WebEDI patched; listed products unaffected
Response information checked: 2026-10-25 Rechecked: 2026-10-27

Business-data integration products supplied by Cleo Communications US, LLC.

The advisory updated on 22 October lists Compliance Edition's Cleo WebEDI as patched. Harmony, VLTrader, LexiCom, Clarify, Dashboards, VLProxy and Integration Cloud are listed as unaffected by the two CVEs.

This recheck could not revalidate all listed information against current official sources. The previous verification date is retained. Check official notices or support for current availability and required action.

What users should do

Match your product against the advisory and contact Cleo Support about specific environments or questions.

Official service URL

https://www.cleo.com/

Source URLs

PHP2Shell response and scopehttps://support.cleo.com/hc/en-us/articles/44429839247383-Cleo-Product-Security-Advisory-PHP2Shell-CVE-2026-109618-and-CVE-2026-109619-CVSS-v4-0-CriticalResponse evidence
Operating entityhttps://www.cleo.com/terms-and-conditions-fulfillment-portal-services-agreementService and operation documentation
Official service and authorhttps://www.cleo.com/blog/responding-to-integration-changesService and operation documentation

Related official sources

PHP2Shell response and scopeOfficial notice
Operating entityOfficial information directory
Official service and authorOfficial information directory