VulnTideExploited vulnerabilities, by vendor. Data as of .
Not in CISA KEVReported exploited: VulnCheck KEV since Published CVSS 9.8 criticalEPSS 95.1% probability of exploitation in 30 days
Fortra

CVE-2024-0204: Authentication Bypass in GoAnywhere MFT

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of .

VulnCheck KEV lists it since . It cites 776 public reports, the first from . VulnCheck's own honeypots also recorded exploitation attempts.

How likely is exploitation in the next 30 days?
95.1%

EPSS score, percentile 99.9 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?
9.8 Critical

CVSS v3.1 base score, given by the CNA

What should I do?

Upgrade to version 7.4.1 or higher. Full textSolution from the CVE record.

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (1)

Which versions are affected?

Affected

  • from 6.0.1 to before 7.4.1

Versions by product

Source: CISA KEV 2026.10.29, as of ; VulnCheck KEV, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.

Description

Authentication Bypass in GoAnywhere MFT

Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.

Source: CVE List, as of . About the data.

What to do

Advisories and patches

Solution (from the CVE record)

Upgrade to version 7.4.1 or higher. The vulnerability may also be eliminated in non-container deployments by deleting the InitialAccountSetup.xhtml file in the install directory and restarting the services. For container-deployed instances, replace the file with an empty file and restart. For additional information, see  https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml  (registration required). https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml

Workaround (from the CVE record)

Users are encouraged to apply defense-in-depth tactics to limit access to the administrative console. Do not expose the console to the internet and apply web application controls such as a WAF, monitoring, and access controls.

This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Versions by product, as listed in the CVE record (1 product)
Fortra GoAnywhere MFT
StatusVersions
Affectedfrom 6.0.1 to before 7.4.1

Versions not listed are: affected.

Source: CVE List, as of . About the data.

Weakness

CWE-425, 1 CAPEC
  • CWE-425: Direct Request ('Forced Browsing')

Attack patterns (CAPEC)

  • CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.

Timeline

DateEvent
CVE record published
CVE record last updated

References

3

Known exploited Fortra vulnerabilities

  • CVE-2025-10035: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability (added )
  • CVE-2022-39197: Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability (added )
  • CVE-2022-42948: Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability (added )
  • CVE-2023-0669: Fortra GoAnywhere MFT Remote Code Execution Vulnerability (added )