VulDB's own description of the exploitation path is authentication bypass through token manipulation, using malformed or replayed bearer tokens against the handler that is supposed to police refresh [11]. The attacker-controlled input is the Bearer argument in the HTTP authorization header [4], which is the one part of a request every client sets for itself. That is why the access requirement collapses to network HTTP with no local or physical foothold [7], and why the stated outcome is privileges beyond those assigned to the account [6].
The two numbers on the record point in opposite directions. EPSS is 0.00284 [16], which is a 0.284 percent chance of exploitation activity in the next 30 days, roughly one in 352 [18]. The same entry marks an exploit as available for download [9], while the write-up describes the public exploit as reported rather than verified [8]. Both sit in one record disclosed on 1 September 2026 and moderated to accepted status [2][15]. Queues sorted by EPSS will bury this. Queues sorted by whether working code exists will not.
What the record withholds matters for scoping. It carries a CVSS 8.3 [3] with no published vector [20], so there is no way to tell from it whether the 8.3 assumes an authenticated caller or an anonymous one. An internet-facing Harmony answering /api/connections is a different exposure from one reachable only across a partner link, and the record does not let you separate them. It also does not assert observed exploitation in the wild [21].
The cost side is small, which is the argument for a short clock. Remediation is an upgrade to 5.8.1.11 or later, and that release contains the correction [13]. From 5.8.1.10 to 5.8.1.11 is a single increment in the fourth version field [19]. The interim advice, tighter input validation on API endpoints and monitoring for unusual bearer token patterns, is explicitly not a substitute for the upgrade [14].
Weigh the product, not the score. Harmony's job is file transfer and API connectivity, and the source's read is that dependent systems carry the impact [17]. Successful exploitation is described as unauthorized administrative access, visibility into sensitive information held in Harmony, and interference with the integration workflows it manages [10], with connected environments offering onward lateral movement [12]. The credentials sitting behind /api/connections are integration credentials for other people's systems. That is the reason a CWE-269 privilege-management bug [5] in this particular box gets patched in days.
