Fortra vulnerabilities
47 CVEs and advisories name Fortra as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-14316Heap buffer overflow in boks_sshd revoked-key error handling
- CVE-2026-9864Fortra BoKS Server Agent adjoin machine-account password generation vulnerability
- CVE-2026-12627Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability
- CVE-2026-79896Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability
- CVE-2026-79898Fortra BoKS Manager crlserver command injection vulnerability
- CVE-2026-79899Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability
- CVE-2026-79900Heap overflow in KSL checksum initialization
- CVE-2026-79901Predictable Active Directory service-account passwords in BoKS Manager
- CVE-2026-15913Path Traversal in Fortra's GoAnywhere MFT Endpoint
- CVE-2026-12164Privilege Escalation in Fortra File Integrity Monitoring (FIM)
- CVE-2026-12163Stored XSS in Fortra File Integrity Monitoring (FIM)
- CVE-2026-9863Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability
- CVE-2026-9862Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability
- CVE-2026-1089User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups
- CVE-2026-0972HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT
- CVE-2026-0971GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout
- CVE-2025-14362GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances
- CVE-2025-1241Encryption vulnerable to brute-force decryption in GoAnywhere MFT
- CVE-2025-13532Weak Password Hash in Core Privileged Access Manager (BoKS)
- CVE-2025-8148CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT
- CVE-2025-10035Deserialization Vulnerability in GoAnywhere MFT's License Servlet
- CVE-2025-8450Unrestricted File Upload in FileCatalyst
- CVE-2025-3871Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier
- CVE-2025-5141Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache
- CVE-2024-11922Input Validation vulnerability in Web Client emails that do not go through Secure Mail
- CVE-2025-0049Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0
- CVE-2024-11923Sensitive Information Disclosure in Fortra Application Hub Prior to version 1.3
- CVE-2024-9945Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0
- CVE-2024-3334USB Security Feature Bypass in Digital Guardian Windows Agent Prior to version 8.2.0
- CVE-2024-8264Sensitive information in agent log file when detailed logging is enabled with Robot Schedule Enterprise prior to version 3.05