Fortra GoAnywhere MFT vulnerabilities

3 known CVE vulnerabilities in Fortra GoAnywhere MFT, translated and rated.

CVE-2026-1089Medium
A user-controlled HTTP header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
CVE-2026-0972Medium
HTML injection is possible in system-generated emails in Fortra's GoAnywhere MFT prior to version 7.10.0. The title, details, and description of this CVE were corrected after publication.
CVE-2026-0971Medium
Fortra GoAnywhere MFT prior to version 7.10.0 contains an improper session timeout issue. This results in SAML-configured Web Users being redirected to the regular login page instead of the SAML login page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS