Goanywhere Mft
Approved changes feed: RSS · Atom
cpe:2.3:a:fortra:goanywhere_mft:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Fortra (f14f6bd1-8bf2-53f9-b0d6-b2745f517ba7) |
|---|---|
| Product | Goanywhere Mft (8a83f2b1-6c5d-552c-bcbe-580e52aad381) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-1089 |
vulnerable | 2026-06-03 15:14:43.746990 |
User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups
MEDIUM (6.5)
User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
Published: 2026-04-21T14:14:58.244Z
Updated: 2026-04-21T15:00:35.492Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0972 |
vulnerable | 2026-06-03 15:14:43.306079 |
HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT
MEDIUM (5.4)
HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0.
Note: The title, details, and description of this CVE were corrected post-publishing.
Published: 2026-04-21T14:14:38.146Z
Updated: 2026-04-29T19:32:13.201Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0971 |
vulnerable | 2026-06-03 15:14:43.304870 |
GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout
MEDIUM (4.3)
An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.
Published: 2026-04-21T14:14:23.423Z
Updated: 2026-04-21T19:26:58.470Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-8148 |
vulnerable | 2026-06-03 15:13:42.995159 |
CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT
MEDIUM (4.2)
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
Published: 2025-12-05T20:56:05.135Z
Updated: 2025-12-05T21:48:44.070Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3871 |
vulnerable | 2026-06-03 15:01:05.824101 |
Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier
MEDIUM (5.3)
Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP.
Published: 2025-07-16T14:00:27.665Z
Updated: 2025-07-18T14:52:28.197Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-1241 |
vulnerable | 2026-06-03 14:58:58.069420 |
Encryption vulnerable to brute-force decryption in GoAnywhere MFT
MEDIUM (5.8)
Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.
Published: 2026-04-21T14:10:09.505Z
Updated: 2026-04-21T19:33:03.005Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14362 |
vulnerable | 2026-06-03 14:58:55.224829 |
GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances
HIGH (7.3)
The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.
Published: 2026-04-21T14:14:08.492Z
Updated: 2026-04-21T19:33:35.079Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-10035 |
vulnerable | 2026-06-03 14:58:33.446533 |
Deserialization Vulnerability in GoAnywhere MFT's License Servlet
CRITICAL (10)
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
Published: 2025-09-18T22:01:51.337Z
Updated: 2026-02-26T17:48:26.229Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9945 |
vulnerable | 2026-06-03 14:58:22.954373 |
Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0
MEDIUM (5.3)
An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders.
Published: 2024-12-13T15:22:31.536Z
Updated: 2025-08-29T20:18:10.908Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25157 |
vulnerable | 2026-06-03 14:55:13.236748 |
Authentication bypass in GoAnywhere MFT prior to 7.6.0
MEDIUM (6.5)
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.
Published: 2024-08-14T15:04:10.987Z
Updated: 2024-08-29T03:55:30.276Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25156 |
vulnerable | 2026-06-03 14:55:13.234701 |
Path traversal in GoAnywhere MFT 7.4.1 and Earlier
MEDIUM (6.5)
A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.
Published: 2024-03-14T14:06:01.498Z
Updated: 2024-08-01T23:36:21.753Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11922 |
vulnerable | 2026-06-03 14:54:15.130790 |
Input Validation vulnerability in Web Client emails that do not go through Secure Mail
MEDIUM (6.3)
Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email.
Published: 2025-04-28T20:57:37.388Z
Updated: 2025-04-28T22:27:53.032Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-0204 |
vulnerable | 2026-06-03 14:54:01.888363 |
Authentication Bypass in GoAnywhere MFT
CRITICAL (9.8)
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
Published: 2024-01-22T18:05:13.194Z
Updated: 2025-05-30T14:22:31.288Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0669 |
vulnerable | 2026-06-03 14:48:52.407495 |
Fortra GoAnywhere MFT License Response Servlet Command Injection
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
Published: 2023-02-06T19:16:19.265Z
Updated: 2025-10-21T23:15:27.683Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.