What’s Vulnerable › Vulnerabilities
CVE-2024-25157: Authentication bypass in GoAnywhere MFT prior to 7.6.0
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-08-14 · updated 2026-06-17
- Weakness: CWE-303
Description
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.
Affected products
- Fortra GoAnywhere MFT: before 7.6.0 — fixed in 7.6.0
How to fix
Upgrade to a fixed version: Fortra GoAnywhere MFT 7.6.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-25157 or the next vulnerability affects your stack