Cleo have issued a (paywalled) advisory about the zero day, saying a new CVE number is being allocated.