Read the docs
TI-2023-00634 Aliases CVE-2023-0669

Fortra GoAnywhere MFT License Response Servlet Command Injection

Priority CRITICAL 91Exploited in the wildCWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-502.

Summary

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

Why it matters now

Exploitation Active In CISA KEV since 2023-02-10CISA due date 2023-03-03Known ransomware use
EPSS 0.99999 99th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FortraGoanywhere MFTup to 7.1.1—No fix listedCNA
  • Goanywhere MFT VendorFortra Affected up to 7.1.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*before 7.1.2VulnerableFortra
  • cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:* Versions before 7.1.2 Vulnerable ·Fortra

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2023-02-10 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2023-0669

References

Exploit 4

Advisory 4

  • TI-2025-09211 Deserialization Vulnerability in GoAnywhere MFT's License Servlet KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-00185 Authentication Bypass in GoAnywhere MFT CVSS 3.1CRITICAL 9.8
  • TI-2025-13122 GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances CVSS 3.1HIGH 7.3
  • TI-2026-00820 User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups CVSS 3.1MEDIUM 6.5
  • TI-2024-16608 Authentication bypass in GoAnywhere MFT prior to 7.6.0 CVSS 3.1MEDIUM 6.5
  • TI-2026-00737 HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT CVSS 3.1MEDIUM 5.4
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences