CVE-2026-0972
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
HTML injection is possible in system-generated emails in Fortra's GoAnywhere MFT prior to version 7.10.0. The title, details, and description of this CVE were corrected after publication.
Risk Assessment
This may allow embedding malicious HTML content in system-generated emails, potentially leading to phishing or other attacks on recipients. Organizations using GoAnywhere MFT are exposed to exploitation.
Recommendation
Update Fortra GoAnywhere MFT to version 7.10.0 or later. Review email template configurations for the possibility of injecting untrusted data.
Other vulnerabilities in Fortra GoAnywhere MFT
See all- CVE-2026-1089Medium
A user-controlled HTTP header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
- CVE-2026-0971Medium
Fortra GoAnywhere MFT prior to version 7.10.0 contains an improper session timeout issue. This results in SAML-configured Web Users being redirected to the regular login page instead of the SAML login page.
Original NVD description (English source)
HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS