CVE-2026-0971
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Fortra GoAnywhere MFT prior to version 7.10.0 contains an improper session timeout issue. This results in SAML-configured Web Users being redirected to the regular login page instead of the SAML login page.
Risk Assessment
SAML users may be redirected to the wrong login page, potentially hindering access or leading them to enter credentials in the wrong place.
Recommendation
Update Fortra GoAnywhere MFT to version 7.10.0 or later to fix the session timeout issue and ensure proper SAML redirection.
Other vulnerabilities in Fortra GoAnywhere MFT
See all- CVE-2026-1089Medium
A user-controlled HTTP header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
- CVE-2026-0972Medium
HTML injection is possible in system-generated emails in Fortra's GoAnywhere MFT prior to version 7.10.0. The title, details, and description of this CVE were corrected after publication.
Original NVD description (English source)
An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS