HIGH🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2023-0669

CVSS 7.2v3.1pub. 2023-02-06upd. 2026-08-06

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Fortra Goanywhere Managed File Transfer

    APP
    Fortra
    < 7.1.2

CISA KEV — detailsi

Vendori
Fortra
Producti
GoAnywhere MFT
Added to KEVi
February 10, 2023
Remediation deadline (US Federal)i
March 3, 2023(overdue)
Ransomwarei
Active ransomware campaigns exploit this vulnerability
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 3 marca 2023
Tags
Deserialization
CWE
References

Related vulnerabilities

CVE-2025-10035CRITICAL10.0⚠ KEVPL ✓same product

Deserialization i command injection w Fortra GoAnywhere MFT (License Servlet)

CVE-2024-0204CRITICAL9.8PL ✓same product

Pominięcie uwierzytelniania w Fortra GoAnywhere MFT — tworzenie konta admina

CVE-2025-14362HIGH7.3same product

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User...

CVE-2025-1241MEDIUM5.8same product

Zaszyfrowane wartości w Fortra GoAnywhere MFT w wersjach przed 7.10.0 oraz w GoAnywhere Agents w wersjach prze...

CVE-2026-0971MEDIUM4.3same product

Nieprawidłowe timeout sesji w Fortra GoAnywhere MFT wcześniejszym od wersji 7.10.0 powoduje, że użytkownicy We...