CVE-2023-0669

Fortra GoAnywhere MFT License Response Servlet Command Injection

HIGH

7.2

CVSS Score

Published: February 6, 2023 at 07:16 PM UTC

Updated: August 6, 2026 at 05:33 AM UTC

1 product affected across 1 vendorGoanywhere Managed File Transfer

Using Goanywhere MFT by Fortra?

Get instant alerts when new vulnerabilities affect Goanywhere MFT - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.2

Exploitation

CISA KEV

Exploit prediction

EPSS 100%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score100.0%

EPSS (Exploit Prediction Scoring System) estimates a 100.0% chance this CVE is exploited in the wild within the next 30 days — higher than 100% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.

Required Action

Apply updates per vendor instructions.

Ransomware Use

Known

Added to KEV

Feb 10, 2023

Remediation Due

Mar 3, 2023

1335 days overdue

Notes

This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://my.goanywhere.com/webclient/DownloadProductFiles.xhtml. Fortra users must have an account in order to login and access the patch.

https://nvd.nist.gov/vuln/detail/CVE-2023-0669

Description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.