GoAnywhere MFT vulnerabilities
3 known CVE vulnerabilities in GoAnywhere MFT, translated and rated.
- CVE-2026-15913High
A path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT before version 7.10.2 allows Web Users with Secure Folders and Secure Mail permissions to escape their sandboxed home directory and read arbitrary files.
- CVE-2025-10035CriticalActively exploited
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
- CVE-2023-0669HighActively exploited
Fortra GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.