CVE-2026-1089
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A user-controlled HTTP header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
Risk Assessment
An attacker could force DNS lookups and potentially access internal information or conduct DNS rebinding attacks.
Recommendation
Update Fortra GoAnywhere MFT to version 7.10.0 or later.
Other vulnerabilities in Fortra GoAnywhere MFT
See all- CVE-2026-0972Medium
HTML injection is possible in system-generated emails in Fortra's GoAnywhere MFT prior to version 7.10.0. The title, details, and description of this CVE were corrected after publication.
- CVE-2026-0971Medium
Fortra GoAnywhere MFT prior to version 7.10.0 contains an improper session timeout issue. This results in SAML-configured Web Users being redirected to the regular login page instead of the SAML login page.
Original NVD description (English source)
User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS