Command Execution on Cleo Harmony via SAML Bypass | Kill Chains and Coffee

Kill Chains and Coffee · Sep 24, 2026 · 19m

In the AI era, it’s critical to test your attack surface just like an adversary would. Identifying truly exploitable risk means chaining together all possible vulnerabilities, rather than stopping when you find one.

In this episode of “Kill Chains and Coffee,” host Greg Heon and Armadin red team expert Ilyass El Hadi revisited a recent kill chain that led to an exploit of Cleo Harmony, a managed file transfer application used by thousands of organizations to exchange sensitive documents.

The chain began with unauthenticated external access leading to self-registration on the IdP (Okta). The…