Product by Fortra

    Goanywhere MFT

    15 known vulnerabilities in Goanywhere MFT (Fortra), 2 of them actively exploited (CISA KEV).

    Key figures

    15

    Vulnerabilities

    2

    Actively exploited (KEV)

    2

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Goanywhere MFT (Fortra)
    CriticalCVE-2025-10035

    Deserialization Vulnerability in GoAnywhere MFT's License Servlet

    In CISA KEVRansomwarealso in 1 other product

    		10.0
    CriticalCVE-2023-0669

    Fortra GoAnywhere MFT License Response Servlet Command Injection

    In CISA KEVRansomwarealso in 1 other product

    		7.2
    CriticalCVE-2024-0204

    Authentication Bypass in GoAnywhere MFT

    also in 1 other product

    		9.8
    HighCVE-2026-15913

    Path Traversal in Fortra's GoAnywhere MFT Endpoint

    		7.7
    HighCVE-2025-14362

    GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances

    also in 1 other product

    		7.3
    MediumCVE-2024-25157

    Authentication bypass in GoAnywhere MFT prior to 7.6.0

    also in 1 other product

    		6.5
    MediumCVE-2026-1089

    User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups

    also in 1 other product

    		6.5
    MediumCVE-2025-1241

    Encryption vulnerable to brute-force decryption in GoAnywhere MFT

    also in 1 other product

    		5.8
    MediumCVE-2024-25156

    Path traversal in GoAnywhere MFT 7.4.1 and Earlier

    also in 1 other product

    		6.5
    MediumCVE-2025-3871

    Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier

    		5.3
    MediumCVE-2026-0972

    HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT

    also in 1 other product

    		5.4
    MediumCVE-2024-11922

    Input Validation vulnerability in Web Client emails that do not go through Secure Mail

    also in 1 other product

    		6.3
    MediumCVE-2026-0971

    GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout

    also in 1 other product

    		4.3
    MediumCVE-2024-9945

    Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0

    		5.3
    MediumCVE-2025-8148

    Fortra GoAnywhere MFT: Incorrect Permission Assignment for Critical Resource

    also in 1 other product

    		4.2

    All products by Fortra