https://vulnogram.org/ Most recent CVEs assigned by Fortra, LLC (fortra). https://vulnogram.org/seaview/icons/fortra.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-14316 https://vulnogram.org/CVE-2026-14316 The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap all… High Network Exploitable Thu, 01 Oct 2026 16:16:36 GMT https://vulnogram.org/CVE-2026-9864 https://vulnogram.org/CVE-2026-9864 Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended… Medium Network Exploitable Thu, 01 Oct 2026 16:00:25 GMT https://vulnogram.org/CVE-2026-12627 https://vulnogram.org/CVE-2026-12627 Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client re… Critical Network Exploitable Thu, 01 Oct 2026 15:29:41 GMT https://vulnogram.org/CVE-2026-79896 https://vulnogram.org/CVE-2026-79896 Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normal… High Network Exploitable Thu, 01 Oct 2026 15:09:21 GMT https://vulnogram.org/CVE-2026-79898 https://vulnogram.org/CVE-2026-79898 Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be proc… Critical Thu, 01 Oct 2026 14:57:28 GMT https://vulnogram.org/CVE-2026-79899 https://vulnogram.org/CVE-2026-79899 Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may… High Thu, 01 Oct 2026 14:37:23 GMT https://vulnogram.org/CVE-2026-79900 https://vulnogram.org/CVE-2026-79900 boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field be… Medium Thu, 01 Oct 2026 14:11:55 GMT https://vulnogram.org/CVE-2026-79901 https://vulnogram.org/CVE-2026-79901 In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service pr… Critical Thu, 01 Oct 2026 13:52:27 GMT https://vulnogram.org/CVE-2026-15913 https://vulnogram.org/CVE-2026-15913 In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitra… High Wed, 09 Sep 2026 21:18:54 GMT https://vulnogram.org/CVE-2026-12164 https://vulnogram.org/CVE-2026-12164 Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also… Medium Tue, 23 Jun 2026 22:15:37 GMT https://vulnogram.org/CVE-2026-12163 https://vulnogram.org/CVE-2026-12163 Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the Asset View UI component. An authenticated user with sufficient privileges to create or mo… Medium Tue, 23 Jun 2026 22:06:04 GMT https://vulnogram.org/CVE-2026-9863 https://vulnogram.org/CVE-2026-9863 Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able… High Network Exploitable Mon, 15 Jun 2026 15:17:19 GMT https://vulnogram.org/CVE-2026-9862 https://vulnogram.org/CVE-2026-9862 Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of… Critical Network Exploitable Mon, 15 Jun 2026 15:10:08 GMT https://vulnogram.org/CVE-2026-1089 https://vulnogram.org/CVE-2026-1089 User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure. Medium Network Exploitable Tue, 21 Apr 2026 14:14:58 GMT https://vulnogram.org/CVE-2026-0972 https://vulnogram.org/CVE-2026-0972 HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing. Medium Tue, 21 Apr 2026 14:14:38 GMT https://vulnogram.org/CVE-2026-0971 https://vulnogram.org/CVE-2026-0971 An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page. Medium Network Exploitable Tue, 21 Apr 2026 14:14:23 GMT https://vulnogram.org/CVE-2025-14362 https://vulnogram.org/CVE-2025-14362 The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force. High Network Exploitable Tue, 21 Apr 2026 14:14:08 GMT https://vulnogram.org/CVE-2025-1241 https://vulnogram.org/CVE-2025-1241 Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data. Medium Tue, 21 Apr 2026 14:10:09 GMT https://vulnogram.org/CVE-2026-2636 https://vulnogram.org/CVE-2026-2636 This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an u… Medium Wed, 25 Feb 2026 18:57:02 GMT https://vulnogram.org/CVE-2025-13532 https://vulnogram.org/CVE-2025-13532 Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running i… Medium Tue, 16 Dec 2025 20:01:02 GMT https://vulnogram.org/CVE-2025-8148 https://vulnogram.org/CVE-2025-8148 An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key. Medium Fri, 05 Dec 2025 20:56:05 GMT https://vulnogram.org/CVE-2025-10035 https://vulnogram.org/CVE-2025-10035 A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. Critical Known Exploited Network Exploitable Thu, 18 Sep 2025 22:01:51 GMT https://vulnogram.org/CVE-2025-8450 https://vulnogram.org/CVE-2025-8450 Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page. High Network Exploitable Tue, 19 Aug 2025 18:01:14 GMT https://vulnogram.org/CVE-2025-3871 https://vulnogram.org/CVE-2025-3871 Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an em… Medium Network Exploitable Wed, 16 Jul 2025 14:00:27 GMT https://vulnogram.org/CVE-2025-5141 https://vulnogram.org/CVE-2025-5141 A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), 9.0.0 (up to 9.0.0.1) and also legacy tar installs of BoKS 7.2 without ho… Medium Tue, 17 Jun 2025 19:30:51 GMT https://vulnogram.org/CVE-2024-11922 https://vulnogram.org/CVE-2024-11922 Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email. Medium Mon, 28 Apr 2025 20:57:37 GMT https://vulnogram.org/CVE-2025-0049 https://vulnogram.org/CVE-2025-0049 When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before… Low Mon, 28 Apr 2025 20:55:06 GMT https://vulnogram.org/CVE-2024-11923 https://vulnogram.org/CVE-2024-11923 Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub (Formerly named Helpsystems One) prior to version 1.3 Medium Fri, 17 Jan 2025 23:44:06 GMT https://vulnogram.org/CVE-2024-9945 https://vulnogram.org/CVE-2024-9945 An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders. Medium Network Exploitable Fri, 13 Dec 2024 15:22:31 GMT https://vulnogram.org/CVE-2024-3334 https://vulnogram.org/CVE-2024-3334 A security bypass vulnerability exists in the Removable Media Encryption (RME)component of Digital Guardian Windows Agents prior to version 8.2.0. This allows a user to circumvent encryption controls by modifying metadata on the USB device thereby co… Medium Fri, 15 Nov 2024 19:57:28 GMT https://vulnogram.org/CVE-2024-8264 https://vulnogram.org/CVE-2024-8264 Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enabled. Medium Wed, 09 Oct 2024 22:44:35 GMT https://vulnogram.org/CVE-2024-6769 https://vulnogram.org/CVE-2024-6769 A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate fr… High Thu, 26 Sep 2024 20:18:38 GMT https://vulnogram.org/CVE-2024-6632 https://vulnogram.org/CVE-2024-6632 A vulnerability exists in FileCatalyst Workflow whereby a field accessible to the super admin can be used to perform an SQL injection attack which can lead to a loss of confidentiality, integrity, and availability. High Tue, 27 Aug 2024 14:12:12 GMT https://vulnogram.org/CVE-2024-6633 https://vulnogram.org/CVE-2024-6633 The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credentials could lead to a compromise of confidentiality, integrity, or availability of the softw… Critical Network Exploitable Tue, 27 Aug 2024 14:11:24 GMT https://vulnogram.org/CVE-2024-25157 https://vulnogram.org/CVE-2024-25157 An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclos… Medium Wed, 14 Aug 2024 15:04:10 GMT https://vulnogram.org/CVE-2024-6768 https://vulnogram.org/CVE-2024-6768 A Denial of Service in CLFS.sys in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated low-privilege user to cause a Blue Screen of Death via a forced call to the KeBugC… Medium Mon, 12 Aug 2024 18:29:30 GMT https://vulnogram.org/CVE-2024-5276 https://vulnogram.org/CVE-2024-5276 A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration v… Critical Network Exploitable Tue, 25 Jun 2024 19:13:54 GMT https://vulnogram.org/CVE-2024-5275 https://vulnogram.org/CVE-2024-5275 A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be read out, for example, the private key for certificates. Exploit of this vulnerability could lead to a machine-in… High Tue, 18 Jun 2024 14:11:37 GMT https://vulnogram.org/CVE-2024-4332 https://vulnogram.org/CVE-2024-4332 An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Rol… Critical Network Exploitable Mon, 03 Jun 2024 17:38:54 GMT https://vulnogram.org/CVE-2024-0259 https://vulnogram.org/CVE-2024-0259 Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system p… High Thu, 28 Mar 2024 14:31:07 GMT https://vulnogram.org/CVE-2024-25156 https://vulnogram.org/CVE-2024-25156 A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients. Medium Network Exploitable Thu, 14 Mar 2024 14:06:01 GMT https://vulnogram.org/CVE-2024-25155 https://vulnogram.org/CVE-2024-25155 In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary c… High Network Exploitable Wed, 13 Mar 2024 14:15:54 GMT https://vulnogram.org/CVE-2024-25154 https://vulnogram.org/CVE-2024-25154 Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage. Medium Network Exploitable Wed, 13 Mar 2024 14:13:56 GMT https://vulnogram.org/CVE-2024-25153 https://vulnogram.org/CVE-2024-25153 A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploade… Critical Network Exploitable Wed, 13 Mar 2024 14:10:36 GMT https://vulnogram.org/CVE-2024-0204 https://vulnogram.org/CVE-2024-0204 Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. Critical Network Exploitable Mon, 22 Jan 2024 18:05:13 GMT