Description
Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortra | GoAnywhere MFT | < 7.10.0 | 7.10.0 |
Advisories 1
- WID-SEC-2026-1216 Fortra GoAnywhere MFT: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 22, 2026