# Fortra GoAnywhere MFT.

Every CVE that names Fortra GoAnywhere MFT among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Path Traversal in Fortra's GoAnywhere MFT Endpoint](https://agentprime.io/advisories/CVE-2026-15913.md)
  `CVE-2026-15913` · CVE record: Fortra GoAnywhere MFT · CVSS 7.7 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal
- [User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups](https://agentprime.io/advisories/CVE-2026-1089.md)
  `CVE-2026-1089` · CVE record: Fortra GoAnywhere MFT · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Other injection
- [HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT](https://agentprime.io/advisories/CVE-2026-0972.md)
  `CVE-2026-0972` · CVE record: Fortra GoAnywhere MFT · CVSS 5.4 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Other injection
- [GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout](https://agentprime.io/advisories/CVE-2026-0971.md)
  `CVE-2026-0971` · CVE record: Fortra GoAnywhere MFT · CVSS 4.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Authentication bypass
- [GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances](https://agentprime.io/advisories/CVE-2025-14362.md)
  `CVE-2025-14362` · CVE record: Fortra GoAnywhere MFT · CVSS 7.3 High · Not analysed yet · Published 21 Apr 2026 · Tags: Authentication bypass
- [Encryption vulnerable to brute-force decryption in GoAnywhere MFT](https://agentprime.io/advisories/CVE-2025-1241.md)
  `CVE-2025-1241` · CVE record: Fortra GoAnywhere MFT · CVSS 5.8 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Weak cryptography or TLS
- [CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT](https://agentprime.io/advisories/CVE-2025-8148.md)
  `CVE-2025-8148` · CVE record: Fortra GoAnywhere MFT · CVSS 4.2 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Broken access control
- [Deserialization Vulnerability in GoAnywhere MFT's License Servlet](https://agentprime.io/advisories/CVE-2025-10035.md)
  `CVE-2025-10035` · CVE record: Fortra GoAnywhere MFT · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 18 Sept 2025 · Tags: Command injection, Insecure deserialization
- [Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier](https://agentprime.io/advisories/CVE-2025-3871.md)
  `CVE-2025-3871` · CVE record: Fortra GoAnywhere MFT · CVSS 5.3 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Broken access control
- [Input Validation vulnerability in Web Client emails that do not go through Secure Mail](https://agentprime.io/advisories/CVE-2024-11922.md)
  `CVE-2024-11922` · CVE record: Fortra GoAnywhere MFT · CVSS 6.3 Medium · Not analysed yet · Published 28 Apr 2025 · Tags: Cross-site scripting (XSS)
- [Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0](https://agentprime.io/advisories/CVE-2024-9945.md)
  `CVE-2024-9945` · CVE record: Fortra GoAnywhere MFT · CVSS 5.3 Medium · Not analysed yet · Published 13 Dec 2024 · Tags: Information disclosure, Broken access control
- [Authentication bypass in GoAnywhere MFT prior to 7.6.0](https://agentprime.io/advisories/CVE-2024-25157.md)
  `CVE-2024-25157` · CVE record: Fortra GoAnywhere MFT · CVSS 6.5 Medium · Not analysed yet · Published 14 Aug 2024 · Tags: Authentication bypass
- [Path traversal in GoAnywhere MFT 7.4.1 and Earlier](https://agentprime.io/advisories/CVE-2024-25156.md)
  `CVE-2024-25156` · CVE record: Fortra GoAnywhere MFT · CVSS 6.5 Medium · Not analysed yet · Published 14 Mar 2024 · Tags: Path traversal
- [Authentication Bypass in GoAnywhere MFT](https://agentprime.io/advisories/CVE-2024-0204.md)
  `CVE-2024-0204` · CVE record: Fortra GoAnywhere MFT · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.95 · Not analysed yet · Published 22 Jan 2024 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=fortra-goanywhere-mft>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/fortra-goanywhere-mft/>. Everything for agents: <https://agentprime.io/llms.txt>.