What’s Vulnerable › Products
Fortra GoAnywhere MFT vulnerabilities
16 known vulnerabilities, 2 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.
Check whether your Fortra GoAnywhere MFT version is affected
Exploited Fortra GoAnywhere MFT vulnerabilities
- CVE-2025-10035 — Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
- CVE-2023-0669 — Fortra GoAnywhere MFT Remote Code Execution Vulnerability
Latest Fortra GoAnywhere MFT vulnerabilities
- CVE-2026-15913 — Path Traversal in Fortra's GoAnywhere MFT Endpoint (CVSS 7.7)
- CVE-2026-1089 — User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups (CVSS 6.5)
- CVE-2026-0972 — HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT (CVSS 5.4)
- CVE-2026-0971 — GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout (CVSS 4.3)
- CVE-2025-14362 — GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances (CVSS 7.3)
- CVE-2025-1241 — Encryption vulnerable to brute-force decryption in GoAnywhere MFT (CVSS 4.9)
- CVE-2025-8148 — CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT (CVSS 4.2)
- CVE-2025-10035 — Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability (CVSS 9.8) — exploited
- CVE-2025-3871 — Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier (CVSS 5.3)
- CVE-2025-0049 — Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0 (CVSS 4.3)
- CVE-2024-11922 — Input Validation vulnerability in Web Client emails that do not go through Secure Mail (CVSS 5.4)
- CVE-2024-9945 — Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0 (CVSS 5.3)
- CVE-2024-25157 — Authentication bypass in GoAnywhere MFT prior to 7.6.0 (CVSS 6.5)
- CVE-2024-25156 — Path traversal in GoAnywhere MFT 7.4.1 and Earlier (CVSS 6.5)
- CVE-2024-0204 — Authentication Bypass in GoAnywhere MFT (CVSS 9.8)
- CVE-2023-0669 — Fortra GoAnywhere MFT Remote Code Execution Vulnerability (CVSS 7.2) — exploited