Fortra vulnerabilities
- Fortra has 43 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #220 of 420 vendors on this site by that count.
- Of the 42 with a CVSS score, 21 (50%) are rated critical or high; 1 (2.3% of all) have no CVSS score.
- 4 vulnerabilities attributed to Fortra are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog; the most recent, CVE-2025-10035, was added on 29 Sep 2025.
- 2 of them (50%) are marked as known to be used in ransomware campaigns.
- For the 4 KEV entries with a published CVE record, the median time from CVE publication to KEV listing is 9 days.
Records are attributed to Fortra from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 0 |
| 2018 | 0 |
| 2019 | 0 |
| 2020 | 0 |
| 2021 | 0 |
| 2022 | 1 |
| 2023 | 6 |
| 2024 | 15 |
| 2025 | 9 |
| 2026 | 18 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 18 | 4 | 6 | 55.6% | 0% |
| 2025 | 9 | 1 | 1 | 22.2% | 0% |
| 2024 | 15 | 5 | 4 | 60% | 0% |
| 2023 | 6 | 1 | 1 | 100% | 66.7% |
| 2022 | 1 | 0 | 0 | 0% | 0% |
| 2021 | 0 | 0 | 0 | — | — |
| 2020 | 0 | 0 | 0 | — | — |
| 2019 | 0 | 0 | 0 | — | — |
| 2018 | 0 | 0 | 0 | — | — |
| 2017 | 0 | 0 | 0 | — | — |
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Exploited vulnerabilities in CISA's KEV catalog
| CVE | Product | Name | Added | Ransomware |
|---|---|---|---|---|
| CVE-2025-10035 | GoAnywhere MFT | Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability | 2025-09-29 | Known |
| CVE-2022-39197 | Cobalt Strike | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability | 2023-03-30 | Unknown |
| CVE-2022-42948 | Cobalt Strike | Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability | 2023-03-30 | Unknown |
| CVE-2023-0669 | GoAnywhere MFT | Fortra GoAnywhere MFT Remote Code Execution Vulnerability | 2023-02-10 | Known |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring Fortra records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2023-0669 | 100% | 100% | High | Yes |
| CVE-2025-10035 | 99.8% | 100% | Critical | Yes |
| CVE-2024-0204 | 95.1% | 99.9% | Critical | No |
| CVE-2024-5276 | 90.1% | 99.8% | Critical | No |
| CVE-2022-39197 | 46.7% | 98.8% | Medium | Yes |
| CVE-2024-25153 | 41.7% | 98.7% | Critical | No |
| CVE-2022-42948 | 2.7% | 85.9% | Critical | Yes |
| CVE-2024-6633 | 1.2% | 67.2% | Critical | No |
| CVE-2026-79898 | 1% | 62.5% | Critical | No |
| CVE-2026-9862 | 1% | 62.5% | Critical | No |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.