https://pwn.watch/t/fortra Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Mon, 29 Sep 2025 00:00:00 GMT https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035 https://pwn.watch/i/fortra-goanywhere-mft-cve-2025-10035 Mon, 29 Sep 2025 00:00:00 GMT critical <p>Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. Added to CISA KEV on 2025-09-29.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-09-29: CISA added CVE-2025-10035 to the KEV catalog (due 2025-10-20).</li></ul> <p><strong>CVEs:</strong> CVE-2025-10035</p> https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948 https://pwn.watch/i/fortra-cobalt-strike-cve-2022-39197-42948 Thu, 30 Mar 2023 00:00:00 GMT critical <p>Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely. Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. Added to CISA KEV on 2023-03-30.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2023-03-30: CISA added CVE-2022-39197 to the KEV catalog (due 2023-04-20).</li><li>2023-03-30: CISA added CVE-2022-42948 to the KEV catalog (due 2023-04-20).</li></ul> <p><strong>CVEs:</strong> CVE-2022-39197, CVE-2022-42948</p> https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669 https://pwn.watch/i/goanywhere-mft-cl0p-cve-2023-0669 Fri, 10 Feb 2023 00:00:00 GMT high <p>A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 7.1.2</p> <p><strong>Latest updates:</strong></p><ul><li>2023-02-10: CISA adds CVE-2023-0669 to KEV; Cl0p claims it breached over 130 organisations (<a href="https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-it-breached-130-orgs-using-goanywhere-zero-day/">source</a>)</li><li>2023-02-07: Emergency patch: GoAnywhere MFT 7.1.2 (<a href="https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/">source</a>)</li><li>2023-02-01: Fortra privately warns customers of an actively exploited zero-day in the GoAnywhere admin console (<a href="https://www.bleepingcomputer.com/news/security/actively-exploited-goanywhere-mft-zero-day-gets-emergency-patch/">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-0669</p>