Fortra
Security incidents tagged Fortra. Newest first.
0 Fortra incidents in the last 12 months
- Incidents
- 3
- Live
- 0
- Patched
- 3
- Days without an incident
- 388
- Longest quiet run: 913 days (Mar 31–Sep 28)
Show 3 older incidents3 older incidents
September 2025 1
CriticalFortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data VulnerabilityPatched
Fortra GoAnywhere MFT Patched
Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. Added to CISA KEV on 2025-09-29.
Open incident →CVE-2025-10035
March 2023 1
CriticalFortra Cobalt Strike: 2 exploited vulnerabilities (CVE-2022-39197, CVE-2022-42948)Patched
Fortra Cobalt Strike Patched
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely. Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. Added to CISA KEV on 2023-03-30.
Open incident →CVE-2022-39197 · CVE-2022-42948
February 2023 1
HighFortra GoAnywhere MFT zero-day: Cl0p claims 130 victimsPatched
Fortra GoAnywhere MFT Patched
A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.
Open incident →CVE-2023-0669
