Vulnerabilidades do Fortra Goanywhere Managed File Transfer
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Fortra Goanywhere Managed File Transfer: 8 registro(s), com versões afetadas e correções.cpe:2.3:a:fortra:goanywhere_managed_file_transfer
CVE-2026-1089
Média · 6.5
CWE-74 21/04/2026
User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups
User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
CVE-2026-0972
Média · 5.4
CWE-74 21/04/2026
HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT
HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0.
Note: The title, details, and description of this CVE were corrected post-publishing.
CVE-2026-0971
Média · 4.3
CWE-613 21/04/2026
GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout
An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.
CVE-2025-1241
Média · 4.9
CWE-326 21/04/2026
Encryption vulnerable to brute-force decryption in GoAnywhere MFT
Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.
CVE-2025-14362
Alta · 7.3
CWE-307 21/04/2026
GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances
The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.
CVE-2025-8148
Média · 4.2
CWE-732 05/12/2025
CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
CVE-2025-10035
Crítica · 9.8
KEV Urgente · 83 Exploit público Ransomware CWE-77 18/09/2025
Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
CVE-2023-0669
Alta · 7.2
KEV Urgente · 86 Exploit público Ransomware CWE-502 06/02/2023
Fortra GoAnywhere MFT Remote Code Execution Vulnerability
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.