GoAnywhere MFT
- Software type
- File transfer
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/21/2026, GoAnywhere MFT recorded 1 security vulnerability in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of GoAnywhere MFT and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-15913Path Traversal in Fortra's GoAnywhere MFT EndpointCVE-2026-1089User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS LookupsCVE-2026-0972HTML Injection possible in system generated emails in Fortra's GoAnywhere MFTCVE-2026-0971GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeoutCVE-2025-14362GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-15913Path Traversal in Fortra's GoAnywhere MFT Endpoint | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-1089User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups | Exploitation statusNot exploited | FixYes | Published04/21/2026 | SeverityMedium |
|---|
CVE-2026-0972HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT | Exploitation statusNot exploited | FixYes | Published04/21/2026 | SeverityMedium |
|---|
CVE-2026-0971GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout | Exploitation statusNot exploited | FixYes | Published04/21/2026 | SeverityMedium |
|---|
CVE-2025-14362GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances | Exploitation statusNot exploited | FixYes | Published04/21/2026 | SeverityHigh |
|---|
CVE-2025-1241Encryption vulnerable to brute-force decryption in GoAnywhere MFT | Exploitation statusNot exploited | FixYes | Published04/21/2026 | SeverityMedium |
|---|
CVE-2025-8148CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT | Exploitation statusNot exploited | FixYes | Published12/05/2025 | SeverityMedium |
|---|
CVE-2025-10035Deserialization Vulnerability in GoAnywhere MFT's License Servlet | Exploitation statusKEV | FixYes | Published09/18/2025 | SeverityCritical |
|---|
CVE-2025-3871Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier | Exploitation statusNot exploited | FixYes | Published07/16/2025 | SeverityMedium |
|---|
CVE-2024-11922Input Validation vulnerability in Web Client emails that do not go through Secure Mail | Exploitation statusNot exploited | FixYes | Published04/28/2025 | SeverityMedium |
|---|
15 Results | Page 1 of 2