CVE-2026-1089

< 7.10.0

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well

6.5MEDIUM

CVE-2026-0972

< 7.10.0

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and

5.4MEDIUM

CVE-2026-0971

< 7.10.0

An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being re

4.3MEDIUM

CVE-2025-1241

< 7.10.0

Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static

5.8MEDIUM

CVE-2025-14362

< 7.10.0

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be l

7.3HIGH

CVE-2025-8148

< 7.9.0

An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authenti

4.2MEDIUM

CVE-2025-10035

< 7.6.3

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license re

10.0CRITICAL

CVE-2025-0049

< 7.8.0

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message i

3.5LOW

CVE-2024-11922

< 7.8.0

Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker wi

6.3MEDIUM

CVE-2024-25157

< 7.6.0

An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to cir

6.5MEDIUM

CVE-2024-25156

< 7.4.2

A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific perm

6.5MEDIUM

CVE-2024-0204

>= 7.0.0 and < 7.4.1

Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the admini

9.8CRITICAL

CVE-2023-0669

< 7.1.2

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Res

7.2HIGH

CVE-2021-46830

< 6.8.3

A path traversal vulnerability exists within GoAnywhere MFT before 6.8.3 that utilize self-registration for the GoAnywhere Web Cli

6.5MEDIUM