Known vulnerabilities in GoAnywhere MFT

Vendor: Fortra
Software CPE: cpe:2.3:a:fortra:goanywhere_mft:*:*:*:*:*:*:*:*
Total vulnerabilities: 14
Public exploits: 2
Known exploited (KEV): 3
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting GoAnywhere MFT GoAnywhere MFT is affected by 14 known vulnerabilities: 3 critical, 4 medium, 7 low Critical High Medium Low

Vulnerabilities (14)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134967 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-0972
CWE-74 Low
No
No
7.10.0 19.06.2026 SB20260619125
#VU134966 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-1089
CWE-74 Medium
No
No
7.10.0 19.06.2026 SB20260619125
#VU134965 - Insufficient Session Expiration
CVE-2026-0971
CWE-613 Low
No
No
7.10.0 19.06.2026 SB20260619125
#VU134964 - Improper Restriction of Excessive Authentication Attempts
CVE-2025-14362
CWE-307 Medium
No
No
7.10.0 19.06.2026 SB20260619125
#VU134963 - Inadequate Encryption Strength
CVE-2025-1241
CWE-326 Low
No
No
7.10.0 19.06.2026 SB20260619125
#VU116002 - Deserialization of Untrusted Data
CVE-2025-10035
CWE-502 Critical
No
Exploited
7.6.3, 7.8.4 22.09.2025 SB2025092253
#VU113005 - Insufficient Verification of Data Authenticity
CVE-2025-3871
CWE-345 Low
No
No
7.8.1 16.07.2025 SB20250716134
#VU108031 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-11922
CWE-79 Low
No
No
7.8.0 29.04.2025 SB2025042920
#VU108030 - Information Exposure Through an Error Message
CVE-2025-0049
CWE-209 Medium
No
No
7.8.0 29.04.2025 SB2025042920
#VU101779 - Exposure of sensitive information to an unauthorized actor
CVE-2024-9945
CWE-200 Low
No
No
7.7.0 13.12.2024 SB2024121364
#VU100235 - Improper Access Control
CVE-2024-25157
CWE-284 Low
No
No
7.6.0 11.11.2024 SB2024111151
#VU87590 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-25156
CWE-22 Medium
No
No
7.4.2 18.03.2024 SB2024031833
#VU85739 - Missing Authorization
CVE-2024-0204
CWE-862 Critical
Available
Exploited
7.4.1 24.01.2024 SB2024012410
SB2024032024
#VU71774 - Deserialization of Untrusted Data
CVE-2023-0669
CWE-502 Critical
Available
Exploited
7.1.2 03.02.2023 SB2023020303