Advisories · Technology

Fortra GoAnywhere MFT.

Every CVE that names Fortra GoAnywhere MFT among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-15913 CVE record

CVSS 7.7 High

Path Traversal in Fortra's GoAnywhere MFT Endpoint
- Fortra GoAnywhere MFT
- Path traversal
Not analysed yet 9 Sept 2026
CVE-2026-1089 CVE record

CVSS 6.5 Medium

User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups
- Fortra GoAnywhere MFT
- Other injection
Not analysed yet 21 Apr 2026
CVE-2026-0972 CVE record

CVSS 5.4 Medium

HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT
- Fortra GoAnywhere MFT
- Other injection
Not analysed yet 21 Apr 2026
CVE-2026-0971 CVE record

CVSS 4.3 Medium

GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout
- Fortra GoAnywhere MFT
- Authentication bypass
Not analysed yet 21 Apr 2026
CVE-2025-14362 CVE record

CVSS 7.3 High

GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances
- Fortra GoAnywhere MFT
- Authentication bypass
Not analysed yet 21 Apr 2026
CVE-2025-1241 CVE record

CVSS 5.8 Medium

Encryption vulnerable to brute-force decryption in GoAnywhere MFT
- Fortra GoAnywhere MFT
- Weak cryptography or TLS
Not analysed yet 21 Apr 2026
CVE-2025-8148 CVE record

CVSS 4.2 Medium

CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT
- Fortra GoAnywhere MFT
- Broken access control
Not analysed yet 5 Dec 2025
CVE-2025-10035 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Deserialization Vulnerability in GoAnywhere MFT's License Servlet
- Fortra GoAnywhere MFT
- Command injection
- Insecure deserialization
Not analysed yet 18 Sept 2025
CVE-2025-3871 CVE record

CVSS 5.3 Medium

Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier
- Fortra GoAnywhere MFT
- Broken access control
Not analysed yet 16 Jul 2025
CVE-2024-11922 CVE record

CVSS 6.3 Medium

Input Validation vulnerability in Web Client emails that do not go through Secure Mail
- Fortra GoAnywhere MFT
- Cross-site scripting (XSS)
Not analysed yet 28 Apr 2025
CVE-2024-9945 CVE record

CVSS 5.3 Medium

Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0
- Fortra GoAnywhere MFT
- Information disclosure
- Broken access control
Not analysed yet 13 Dec 2024
CVE-2024-25157 CVE record

CVSS 6.5 Medium

Authentication bypass in GoAnywhere MFT prior to 7.6.0
- Fortra GoAnywhere MFT
- Authentication bypass
Not analysed yet 14 Aug 2024
CVE-2024-25156 CVE record

CVSS 6.5 Medium

Path traversal in GoAnywhere MFT 7.4.1 and Earlier
- Fortra GoAnywhere MFT
- Path traversal
Not analysed yet 14 Mar 2024
CVE-2024-0204 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Authentication Bypass in GoAnywhere MFT
- Fortra GoAnywhere MFT
- Broken access control
Not analysed yet 22 Jan 2024