By year
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Fortra flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2025-10035 Fortra GoAnywhere MFT Deserialization of Untrusted DataExploited since Sep 29, 2025 · ransomware · CVSS 10
- CVE-2022-42948 Fortra Cobalt Strike User Interface Remote Code ExecutionExploited since Mar 30, 2023 · CVSS 9.8
- CVE-2022-39197 Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS)Exploited since Mar 30, 2023 · CVSS 6.1
- CVE-2023-0669 Fortra GoAnywhere MFT Remote Code ExecutionExploited since Feb 10, 2023 · ransomware · CVSS 7.2
Latest high and critical flaws
- CVE-2026-14316 The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer.High 8.1 · Oct 1, 2026
- CVE-2026-79896 Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux.High 7.5 · Oct 1, 2026
- CVE-2026-12627 Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd.Critical 9.8 · Oct 1, 2026
- CVE-2026-79899 Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert.High 7.9 · Oct 1, 2026
- CVE-2026-79898 Fortra BoKS Manager contains a command injection vulnerability in crlserver.Critical 9.1 · Oct 1, 2026
- CVE-2026-79901 In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-raCritical 9.9 · Oct 1, 2026
- CVE-2026-15913 In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure FoldeHigh 7.7 · Sep 9, 2026
- CVE-2026-9863 Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations.High 7.5 · Jun 15, 2026
- CVE-2026-9862 Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service.Critical 9.8 · Jun 15, 2026
- CVE-2025-14362 The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to loHigh 7.3 · Apr 21, 2026
- CVE-2025-10035 Fortra GoAnywhere MFT Deserialization of Untrusted DataExploited · Critical 10 · Sep 18, 2025
- CVE-2025-8450 Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms pageHigh 8.2 · Aug 19, 2025
- CVE-2024-6633 The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article.Critical 9.8 · Aug 27, 2024
- CVE-2024-6632 A vulnerability exists in FileCatalyst Workflow whereby a field accessible to the super admin can be used to perform an SQL injection attack which can lead to aHigh 7.2 · Aug 27, 2024
- CVE-2024-5276 A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.Critical 9.8 · Jun 25, 2024
- CVE-2024-5275 A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be read out, for example, High 7.8 · Jun 18, 2024
- CVE-2024-4332 An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDCritical 9.3 · Jun 3, 2024
- CVE-2024-0259 Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation.High 7.3 · Mar 28, 2024
- CVE-2024-25155 In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subseHigh 7.2 · Mar 13, 2024
- CVE-2024-25153 A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directoryCritical 9.8 · Mar 13, 2024
- CVE-2024-0204 Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.Critical 9.8 · Jan 22, 2024
- CVE-2021-26837 SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers to execute arbitrary Critical 9.8 · Sep 18, 2023
- CVE-2023-2990 Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause High 7.5 · Jun 22, 2023
- CVE-2023-2989 Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash thCritical 9.1 · Jun 22, 2023
- CVE-2022-42948 Fortra Cobalt Strike User Interface Remote Code ExecutionExploited · Critical 9.8 · Mar 24, 2023
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.