Vulnerabilidades de Fortra
CVEs publicadas que afetam produtos de Fortra: 13 registro(s), com severidade, exploração e correções.
GoAnywhere MFT 8Goanywhere Managed File Transfer 8Core Privileged Access Manager (BoKS) 3Core Privileged Access Manager Server 2File Integrity Monitoring 2File Integrity Monitoring (FIM) 2Goanywhere Agents 1
CVE-2026-12164
Média · 4.4
CWE-266 23/06/2026
Privilege Escalation in Fortra File Integrity Monitoring (FIM)
Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission relationships.
CVE-2026-12163
Média · 4.8
CWE-79 23/06/2026
Stored XSS in Fortra File Integrity Monitoring (FIM)
Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the Asset View UI component. An authenticated user with sufficient privileges to create or modify affected node or database configuration fields could store script content that may be rendered as HTML instead of safely escaped text when the affected Asset View UI content is displayed.
CVE-2026-9863
Alta · 8.8
CWE-78 15/06/2026
Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability
Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.
CVE-2026-9862
Crítica · 9.8
CWE-78 15/06/2026
Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability
Fortra's
Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
CVE-2026-1089
Média · 6.5
CWE-74 21/04/2026
User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups
User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
CVE-2026-0972
Média · 5.4
CWE-74 21/04/2026
HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT
HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0.
Note: The title, details, and description of this CVE were corrected post-publishing.
CVE-2026-0971
Média · 4.3
CWE-613 21/04/2026
GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout
An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.
CVE-2025-1241
Média · 4.9
CWE-326 21/04/2026
Encryption vulnerable to brute-force decryption in GoAnywhere MFT
Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.
CVE-2025-14362
Alta · 7.3
CWE-307 21/04/2026
GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances
The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.
CVE-2025-13532
Média · 6.2
CWE-916 16/12/2025
Weak Password Hash in Core Privileged Access Manager (BoKS)
Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.
CVE-2025-8148
Média · 4.2
CWE-732 05/12/2025
CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT
An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
CVE-2025-10035
Crítica · 9.8
KEV Urgente · 83 Exploit público Ransomware CWE-77 18/09/2025
Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
CVE-2023-0669
Alta · 7.2
KEV Urgente · 86 Exploit público Ransomware CWE-502 06/02/2023
Fortra GoAnywhere MFT Remote Code Execution Vulnerability
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.