Emergency patch released for actively exploited GoAnywhere MFT zero-day

Emergency patch released for actively exploited GoAnywhere MFT zero-day

Fortra has released an emergency fix, version 7.1.2, to address a zero-day vulnerability in the GoAnywhere MFT secure file transfer protocol that has been actively exploited by hackers.

The zero-day bug resides in the administrative web interface and could be exploited by a remote attacker to achieve remote code execution via a malicious request. In most cases, the administrator console is not exposed to the internet and should only be accessible via a private internal network or by an allow-listed IP address.

“Due to the nature of the attack, it is critical to note that every managed credential within your GoAnywhere environment should be considered potentially compromised. This includes passwords and keys used to access any external systems with which GoAnywhere is integrated. Ensure that all credentials have been revoked from those external systems and review relevant access logs related to those systems. This also includes passwords and keys used to encrypt files within the system,” Fortra said in a security advisory (available only via a free account).

According to a Shodan search query, there are nearly 1,000 GoAnywhere instances exposed on the internet.

Earlier this week, a proof-of-concept (PoC) code was released that could be used to achieve remote code execution on Internet-exposed and unpatched GoAnywhere MFT servers.

Back to the list

Latest Posts

Over 80K Roundcube webmail servers affected by high-severity RCE flaw

Over 80K Roundcube webmail servers affected by high-severity RCE flaw

Researchers report that an exploit for the vulnerability is already being sold on underground forums.
10 June 2025
Vulnerable Wazuh servers targeted by two Mirai botnets

Vulnerable Wazuh servers targeted by two Mirai botnets

The botnets exploited the flaw to fetch and execute a malicious shell script that serves as a downloader for the main Mirai malware payload.
10 June 2025
China-linked hackers target 70+ orgs across wide range of sectors

China-linked hackers target 70+ orgs across wide range of sectors

The researchers noticed overlaps between PurpleHaze and Chinese cyber espionage groups tracked as APT15 and UNC5174.
10 June 2025