GoAnywhere
Security incidents tagged GoAnywhere. Newest first.
0 GoAnywhere incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 2
- Live
- 0
- Patched
- 2
- Days without an incident
- 388
- Longest quiet run: 961 days (Feb 11–Sep 28)
Show 2 older incidents2 older incidents
September 2025 1
PatchedFortra GoAnywhere MFT: GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
Fortra GoAnywhere MFT
Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. Added to CISA KEV on 2025-09-29.
Open incident →CVE-2025-10035
February 2023 1
PatchedFortra GoAnywhere MFT zero-day: Cl0p claims 130 victims
Fortra GoAnywhere MFT
A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.
Open incident →CVE-2023-0669
