Fortra

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 10.0CriticalSep 18, 2025Fortra GoAnywhere MFT DeserializationCVE-2025-10035(1) GoAnywhere MFT, a managed file transfer product by Fortra, is affected. (2) An attacker gains remote code execution and unauthorized access to sensitive data. (3) Update to the latest version of GoAnywhere MFT, and apply additional security patches as recommended by Fortra.Added to KEV Sep 29, 2025 · 10 days after publicationExploited100% likelyExploit codeNucleiDetection
• 6.1MediumSep 22, 2022Fortra Cobalt Strike XSSCVE-2022-39197Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.Added to KEV Mar 30, 2023 · 189 days after publicationExploited47% likelyExploit code
• 9.8CriticalMar 24, 2023Fortra Cobalt Strike XSSCVE-2022-42948Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.Added to KEV Mar 30, 2023 · 6 days after publicationExploited2.7% likely
• 7.2HighFeb 6, 2023Fortra GoAnywhere MFT DeserializationCVE-2023-0669Web servers and file transfer services using GoAnywhere MFT are affected. An attacker gains remote code execution and potentially sensitive data access. Upgrade to the latest version of GoAnywhere MFT and apply security patches.Added to KEV Feb 10, 2023 · 3 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

Recent

• 8.1HighOct 1, 2026Fortra Core Privileged Access Manager (BoKS) Memory corruptionCVE-2026-14316The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.
• 4.8MediumOct 1, 2026Fortra Core Privileged Access Manager (BoKS) Crypto / certificateCVE-2026-9864Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.
• 7.5HighOct 1, 2026Fortra BoKS Manager Memory corruptionCVE-2026-79896Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normally restarted automatically, repeated requests can sustain the service interruption.
• 9.8CriticalOct 1, 2026Fortra's Core Privileged Access Manager (BoKS) Memory corruptionCVE-2026-12627Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.
• 6.5MediumOct 1, 2026Fortra BoKS Manager boks-server Memory corruptionCVE-2026-79900boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field before copying it. An authenticated KSL client can supply an oversized, OpenSSL-recognized digest name and write beyond the end of the heap allocation.
• 7.9HighOct 1, 2026Fortra BoKS ManagerCVE-2026-79899Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate creation.
• 9.1CriticalOct 1, 2026Fortra BoKS Manager Code / command injectionCVE-2026-79898Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec rule; non-root use of cacrl requires such a rule.
• 9.9CriticalOct 1, 2026Fortra BoKS Manager boks-server Crypto / certificateCVE-2026-79901In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.
• 7.7HighSep 9, 2026Fortra GoAnywhere MFT Path traversal / file handlingCVE-2026-15913In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.
• 4.4MediumJun 23, 2026Fortra file integrity monitoring Privilege escalationCVE-2026-12164Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission relationships.
• 5.5MediumJun 23, 2026Fortra file integrity monitoring XSSCVE-2026-12163Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the Asset View UI component. An authenticated user with sufficient privileges to create or modify affected node or database configuration fields could store script content that may be rendered as HTML instead of safely escaped text when the affected Asset View UI content is displayed.
• 7.5HighJun 15, 2026Fortra core privileged access manager server Code / command injectionCVE-2026-9863Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.
• 9.8CriticalJun 15, 2026Fortra core privileged access manager server Code / command injectionCVE-2026-9862Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
• 6.5MediumApr 21, 2026Fortra goanywhere managed file transfer Code / command injectionCVE-2026-1089User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
• 5.4MediumApr 21, 2026Fortra goanywhere managed file transfer Code / command injectionCVE-2026-0972HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing.
• 4.3MediumApr 21, 2026Fortra goanywhere managed file transferCVE-2026-0971An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.
• 5.8MediumApr 21, 2026Fortra goanywhere agents Crypto / certificateCVE-2025-1241Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.
• 7.3HighApr 21, 2026Fortra goanywhere managed file transferCVE-2025-14362The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.
• 4.2MediumDec 5, 2025Fortra goanywhere managed file transfer Privilege escalationCVE-2025-8148An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.
• 10.0CriticalSep 18, 2025Fortra GoAnywhere MFT DeserializationCVE-2025-10035(1) GoAnywhere MFT, a managed file transfer product by Fortra, is affected. (2) An attacker gains remote code execution and unauthorized access to sensitive data. (3) Update to the latest version of GoAnywhere MFT, and apply additional security patches as recommended by Fortra.Exploited100% likelyExploit codeNucleiDetection
• 9.8CriticalMar 24, 2023Fortra Cobalt Strike XSSCVE-2022-42948Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.Exploited2.7% likely
• 6.1MediumSep 22, 2022Fortra Cobalt Strike XSSCVE-2022-39197Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.Exploited47% likelyExploit code
• 7.2HighFeb 6, 2023Fortra GoAnywhere MFT DeserializationCVE-2023-0669Web servers and file transfer services using GoAnywhere MFT are affected. An attacker gains remote code execution and potentially sensitive data access. Upgrade to the latest version of GoAnywhere MFT and apply security patches.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

See every Fortra entry on the dashboard.

Top products

• goanywhere managed file transfer5 CVEs in the last year
• BoKS Manager3 CVEs in the last year, 1 critical
• file integrity monitoring2 CVEs in the last year
• core privileged access manager server2 CVEs in the last year, 1 critical
• Core Privileged Access Manager (BoKS)2 CVEs in the last year
• BoKS Manager boks-server2 CVEs in the last year, 1 critical
• GoAnywhere MFT1 CVE in the last year
• goanywhere agents1 CVE in the last year
• Fortra's Core Privileged Access Manager (BoKS)1 CVE in the last year, 1 critical