{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T22:28:51.438Z",
  "tag": {
    "id": "fortra",
    "label": "Fortra",
    "isStack": false,
    "url": "https://pwn.watch/t/fortra",
    "feed": "https://pwn.watch/t/fortra/feed.xml"
  },
  "counts": {
    "incidents": 3,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 3
  },
  "incidents": [
    {
      "slug": "fortra-goanywhere-mft-cve-2025-10035",
      "title": "Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability",
      "url": "https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035",
      "json": "https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortra GoAnywhere MFT",
      "tags": [
        "goanywhere",
        "fortra",
        "ransomware",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2025-10035"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-09-29",
      "closedAt": "2025-09-29",
      "updatedAt": "2025-09-29",
      "summary": "Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. Added to CISA KEV on 2025-09-29.",
      "xPost": null
    },
    {
      "slug": "fortra-cobalt-strike-cve-2022-39197-42948",
      "title": "Fortra Cobalt Strike: 2 exploited vulnerabilities (CVE-2022-39197, CVE-2022-42948)",
      "url": "https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948",
      "json": "https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Fortra Cobalt Strike",
      "tags": [
        "fortra",
        "cisa-kev",
        "rce",
        "xss"
      ],
      "cveIds": [
        "CVE-2022-39197",
        "CVE-2022-42948"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-03-30",
      "closedAt": "2023-03-30",
      "updatedAt": "2023-03-30",
      "summary": "Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely. Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. Added to CISA KEV on 2023-03-30.",
      "xPost": null
    },
    {
      "slug": "goanywhere-mft-cl0p-cve-2023-0669",
      "title": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims",
      "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669",
      "json": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Fortra GoAnywhere MFT",
      "tags": [
        "fortra",
        "goanywhere",
        "cl0p",
        "zero-day",
        "rce",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-0669"
      ],
      "affectedVersions": [
        "Before 7.1.2 (NVD)"
      ],
      "fixedVersions": [
        "7.1.2"
      ],
      "startedAt": "2023-02-01",
      "closedAt": "2023-02-10",
      "updatedAt": "2023-02-10",
      "summary": "A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "fortra-goanywhere-mft-cve-2025-10035",
      "incidentTitle": "Fortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-29",
      "title": "CISA added CVE-2025-10035 to the KEV catalog (due 2025-10-20).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035"
    },
    {
      "incident": "fortra-cobalt-strike-cve-2022-39197-42948",
      "incidentTitle": "Fortra Cobalt Strike: 2 exploited vulnerabilities (CVE-2022-39197, CVE-2022-42948)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-30",
      "title": "CISA added CVE-2022-39197 to the KEV catalog (due 2023-04-20).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948"
    },
    {
      "incident": "fortra-cobalt-strike-cve-2022-39197-42948",
      "incidentTitle": "Fortra Cobalt Strike: 2 exploited vulnerabilities (CVE-2022-39197, CVE-2022-42948)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-30",
      "title": "CISA added CVE-2022-42948 to the KEV catalog (due 2023-04-20).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948"
    },
    {
      "incident": "goanywhere-mft-cl0p-cve-2023-0669",
      "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-02-10",
      "title": "CISA adds CVE-2023-0669 to KEV; Cl0p claims it breached over 130 organisations",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-it-breached-130-orgs-using-goanywhere-zero-day/",
      "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669"
    },
    {
      "incident": "goanywhere-mft-cl0p-cve-2023-0669",
      "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-02-07",
      "title": "Emergency patch: GoAnywhere MFT 7.1.2",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/",
      "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669"
    },
    {
      "incident": "goanywhere-mft-cl0p-cve-2023-0669",
      "incidentTitle": "Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-02-01",
      "title": "Fortra privately warns customers of an actively exploited zero-day in the GoAnywhere admin console",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/",
      "url": "https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669"
    }
  ]
}