CVE-2026-0972: HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-21 · updated 2026-10-26
Weakness: CWE-74

Description

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing.

Affected products

Fortra GoAnywhere MFT: before 7.10.0 — fixed in 7.10.0

How to fix

Upgrade to a fixed version: Fortra GoAnywhere MFT 7.10.0. Check the vendor advisory for mitigations.

References

https://www.fortra.com/security/advisories/product-security/fi-2026-006
http://seclists.org/fulldisclosure/2026/Apr/8

Get alerted when CVE-2026-0972 or the next vulnerability affects your stack