Fortra GoAnywhere MFT License Response Servlet Command Injection (CVE-2023-0669)

What is affected, what to do

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update goanywhere_managed_file_transfer to version 7.1.2. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Fortra Goanywhere MFT lte *..7.1.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Establish exposure now: Inventory every GoAnywhere MFT instance and check whether the admin console is reachable from the internet. The defaults are typically 8000/TCP (HTTP) and 8001/TCP (HTTPS), but verify the actual ports in each instance's configuration. If the console is exposed, block it at the perimeter immediately.
   • Patch: Upgrade to GoAnywhere MFT 7.1.2 or later, since 7.1.1 and earlier are vulnerable. Confirm the running version in the admin console afterwards.
   • Workaround if you cannot upgrade today: Disable the License Response Servlet per Fortra's advisory by commenting out its servlet and servlet-mapping entries in the admin web application's web.xml, then restart the service. Look up the exact path and entry in the vendor advisory.
   • Assess for compromise before returning to service: Given the exploitation likelihood and the ransomware flag, assume the host may already be compromised. Preserve logs and a disk snapshot before any cleanup.
   • Rotate credentials: Rotate every secret held by GoAnywhere — admin and web-user accounts, SFTP/FTPS keys, database credentials, partner credentials, and any AD or cloud-storage service accounts the server uses.
   • Trigger reporting workflows: If exfiltration via the MFT platform is suspected, start the NIS2 24-hour early warning to your national CSIRT/authority (BSI in Germany) and GDPR Art. 33 assessment.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Restrict the admin console to a dedicated management VLAN or to access via jump host/VPN. Publish only the actual transfer services (e.g. SFTP, HTTPS web client) externally, never the admin ports.
   • WAF/IPS: Block requests to /goanywhere/lic/accept from untrusted networks and enable vendor IPS signatures for CVE-2023-0669 (Suricata ET, Snort/Talos, and the major NGFW vendors ship coverage). A public Metasploit module exists, so expect commodity scanning.
   • Egress filtering: Allowlist outbound traffic from the MFT host to known partner endpoints only. This breaks reverse shells, payload staging, and bulk exfiltration to attacker infrastructure.
   • Endpoint hardening: Run GoAnywhere under a dedicated low-privilege service account. Use EDR custom rules or AppLocker/WDAC to prevent the Java process from spawning shells (cmd.exe, powershell.exe, /bin/sh, bash).
   • IAM/least privilege: Enforce MFA on the admin console, disable unused admin and web-user accounts, and scope the AD bind account to the minimum rights required.
3. 03

   Runbook step 3

   Detection rules

   • Web/access logs: POST requests to /goanywhere/lic/accept carrying a bundle= parameter from external IPs are a strong exploitation signal. Example SPL: index=web uri_path="/goanywhere/lic/accept" method=POST | stats count by src_ip. Hunt retrospectively back to at least January 2023.
   • EDR/Sysmon process ancestry (EID 1): Look for the GoAnywhere java.exe/Tomcat process as parent of cmd.exe, powershell.exe, rundll32.exe, certutil.exe, or sh/bash. Sigma shape: ParentImage|contains: 'GoAnywhere' AND Image|endswith: ['\cmd.exe','\powershell.exe'].
   • File system (Sysmon EID 11 / auditd): Look for new .jsp, .jar, .dll, or script files in the GoAnywhere install directory or web roots. On Linux, add an auditd watch on the install path with -p wa.
   • GoAnywhere audit log / Windows Security log: Watch for unexpected new admin or web-user accounts in GoAnywhere and new local accounts on the host (EID 4720, 4732). Also flag unusual bulk downloads by web users.
   • Network telemetry (Zeek/Suricata): Look for outbound connections from the MFT host to unfamiliar destinations, upload volumes well above baseline (conn.log orig_bytes), remote-access tooling, or beaconing patterns.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

Source: pwn.watch, OSV (Open Source Vulnerabilities), CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE)

Vendors and products

• Fortra Fortra GoAnywhere MFT
• Fortra Goanywhere MFT

Weakness classes (CWE)

• CWE-502Deserialization of Untrusted Data

  Base

  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

  Entry at MITRE CWE-502

References & sources

• my.goanywhere.comwebclient/ViewSecurityAdvisories.xhtmlVendor advisory
• infosec.exchange@briankrebs/109795710941843934media-coverage
• rapid7.comblog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vu…Third-party advisory
• attackerkb.comtopics/mg883Nbeva/cve-2023-0669/rapid7-analysisThird-party advisory
• github.comrapid7/metasploit-framework/pull/17607Exploit
• duo.comdecipher/fortra-patches-actively-exploited-zero-day-in-goanywhe…media-coverage
• frycos.github.iovulns4free/2023/02/06/goanywhere-forgotten.htmlThird-party advisory
• packetstormsecurity.comfiles/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Exe…
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669government-resource
• NVD (NIST)NVD: CVE-2023-0669advisory, pwn-watch
• github.comrapid7/metasploit-frameworkpackage
• rapid7.comblog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vu…web
• pwn.watchpwn.watch: Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victimspwn-watch
• fortra.comSummary of the Investigation Related to CVE-2023-0669pwn-watch
• bleepingcomputer.comActively exploited GoAnywhere MFT zero-day gets emergency patchpwn-watch
• bleepingcomputer.comClop ransomware claims it breached 130 orgs using GoAnywhere zero-daypwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. CVE Modified06.08.2026134c704f-9b21-4f2e-91b3-4a467353bcc0

   • SSVC: before {"id":"CVE-2023-0669","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technical… after {"id":"CVE-2023-0669","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technical…