Skip to content
OpenAdvisories
Medium WID-SEC-2026-1216 5 CVEs

Fortra GoAnywhere MFT: Mehrere Schwachstellen

Published Apr 21, 2026 · Updated Apr 22, 2026 · Revision 2 · de-DE

Vendor: Fortra Product: GoAnywhere MFT Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Fortra GoAnywhere MFT ausnutzen, um Informationen offenzulegen, Daten zu manipulieren und Sicherheitsmaßnahmen zu umgehen.

Product

GoAnywhere MFT (Managed File Transfer) ist eine Lösung für den sicheren und effizienten Dateitransfer.

Vulnerabilities 5

  • High 7.3
    CVE-2025-14362

    GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances

    The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.

    Fortra GoAnywhere MFT
  • Medium 6.5
    CVE-2026-1089

    User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups

    User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.

    Fortra GoAnywhere MFT
  • Medium 5.8
    CVE-2025-1241

    Encryption vulnerable to brute-force decryption in GoAnywhere MFT

    Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.

    Fortra GoAnywhere MFT
  • Medium 5.4
    CVE-2026-0972

    HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT

    HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing.

    Fortra GoAnywhere MFT
  • Medium 4.3
    CVE-2026-0971

    GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout

    An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.

    Fortra GoAnywhere MFT

Revision history

  1. #2

    Referenzen ergänzt

  2. #1

    Initiale Fassung

References