The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LFortra Goanywhere Managed File Transfer
APPFortra< 7.10.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2025-10035CRITICAL10.0⚠ KEVPL ✓same product
Deserialization i command injection w Fortra GoAnywhere MFT (License Servlet)
CVE-2024-0204CRITICAL9.8PL ✓same product
Pominięcie uwierzytelniania w Fortra GoAnywhere MFT — tworzenie konta admina
CVE-2023-0669HIGH7.2⚠ KEVsame product
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerabilit...
CVE-2025-1241MEDIUM5.8same product
Zaszyfrowane wartości w Fortra GoAnywhere MFT w wersjach przed 7.10.0 oraz w GoAnywhere Agents w wersjach prze...
CVE-2026-0971MEDIUM4.3same product
Nieprawidłowe timeout sesji w Fortra GoAnywhere MFT wcześniejszym od wersji 7.10.0 powoduje, że użytkownicy We...