# cve.now: Fortra

The newest entries naming Fortra as an affected vendor (up to 200), of 47 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-14316](https://cve.now/CVE-2026-14316.md): Heap buffer overflow in boks\_sshd revoked-key error handling (CVSS 8.1)
- [CVE-2026-9864](https://cve.now/CVE-2026-9864.md): Fortra BoKS Server Agent adjoin machine-account password generation vulnerability (CVSS 4.8)
- [CVE-2026-12627](https://cve.now/CVE-2026-12627.md): Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability (CVSS 9.8)
- [CVE-2026-79896](https://cve.now/CVE-2026-79896.md): Fortra BoKS Manager boks\_portmux TLS ClientHello out-of-bounds read vulnerability (CVSS 7.5)
- [CVE-2026-79898](https://cve.now/CVE-2026-79898.md): Fortra BoKS Manager crlserver command injection vulnerability (CVSS 9.1)
- [CVE-2026-79899](https://cve.now/CVE-2026-79899.md): Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability (CVSS 7.9)
- [CVE-2026-79900](https://cve.now/CVE-2026-79900.md): Heap overflow in KSL checksum initialization (CVSS 6.5)
- [CVE-2026-79901](https://cve.now/CVE-2026-79901.md): Predictable Active Directory service-account passwords in BoKS Manager (CVSS 9.9)
- [CVE-2026-15913](https://cve.now/CVE-2026-15913.md): Path Traversal in Fortra's GoAnywhere MFT Endpoint (CVSS 7.7)
- [CVE-2026-12164](https://cve.now/CVE-2026-12164.md): Privilege Escalation in Fortra File Integrity Monitoring (FIM) (CVSS 4.4)
- [CVE-2026-12163](https://cve.now/CVE-2026-12163.md): Stored XSS in Fortra File Integrity Monitoring (FIM) (CVSS 5.5)
- [CVE-2026-9863](https://cve.now/CVE-2026-9863.md): Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability (CVSS 7.5)
- [CVE-2026-9862](https://cve.now/CVE-2026-9862.md): Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability (CVSS 9.8)
- [CVE-2026-1089](https://cve.now/CVE-2026-1089.md): User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups (CVSS 6.5)
- [CVE-2026-0972](https://cve.now/CVE-2026-0972.md): HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT (CVSS 5.4)
- [CVE-2026-0971](https://cve.now/CVE-2026-0971.md): GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout (CVSS 4.3)
- [CVE-2025-14362](https://cve.now/CVE-2025-14362.md): GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances (CVSS 7.3)
- [CVE-2025-1241](https://cve.now/CVE-2025-1241.md): Encryption vulnerable to brute-force decryption in GoAnywhere MFT (CVSS 5.8)
- [CVE-2025-13532](https://cve.now/CVE-2025-13532.md): Weak Password Hash in Core Privileged Access Manager (BoKS) (CVSS 6.2)
- [CVE-2025-8148](https://cve.now/CVE-2025-8148.md): CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT (CVSS 4.2)
- [CVE-2025-10035](https://cve.now/CVE-2025-10035.md): Deserialization Vulnerability in GoAnywhere MFT's License Servlet (CVSS 10.0, KEV)
- [CVE-2025-8450](https://cve.now/CVE-2025-8450.md): Unrestricted File Upload in FileCatalyst (CVSS 8.2)
- [CVE-2025-3871](https://cve.now/CVE-2025-3871.md): Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier (CVSS 5.3)
- [CVE-2025-5141](https://cve.now/CVE-2025-5141.md): Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache (CVSS 5.5)
- [CVE-2024-11922](https://cve.now/CVE-2024-11922.md): Input Validation vulnerability in Web Client emails that do not go through Secure Mail (CVSS 6.3)
- [CVE-2025-0049](https://cve.now/CVE-2025-0049.md): Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0 (CVSS 3.5)
- [CVE-2024-11923](https://cve.now/CVE-2024-11923.md): Sensitive Information Disclosure in Fortra Application Hub Prior to version 1.3 (CVSS 5.5)
- [CVE-2024-9945](https://cve.now/CVE-2024-9945.md): Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0 (CVSS 5.3)
- [CVE-2024-3334](https://cve.now/CVE-2024-3334.md): USB Security Feature Bypass in Digital Guardian Windows Agent Prior to version 8.2.0 (CVSS 4.3)
- [CVE-2024-8264](https://cve.now/CVE-2024-8264.md): Sensitive information in agent log file when detailed logging is enabled with Robot Schedule Enterprise prior to version 3.05 (CVSS 5.5)
- [CVE-2024-6632](https://cve.now/CVE-2024-6632.md): SQL Injection in FileCatalyst Workflow 5.1.6 Build 139 (and earlier) (CVSS 7.2)
- [CVE-2024-6633](https://cve.now/CVE-2024-6633.md): Insecure Default in FileCatalyst Workflow 5.1.6 Build 139 (and earlier) (CVSS 9.8)
- [CVE-2024-25157](https://cve.now/CVE-2024-25157.md): Authentication bypass in GoAnywhere MFT prior to 7.6.0 (CVSS 6.5)
- [CVE-2024-5276](https://cve.now/CVE-2024-5276.md): SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier) (CVSS 9.8)
- [CVE-2024-5275](https://cve.now/CVE-2024-5275.md): Hard-coded password in FileCatalyst Direct 3.8.10 Build 138 TransferAgent (and earlier) and FileCatalyst Workflow 5.1.6 Build 130 (and earlier) (CVSS 7.8)
- [CVE-2024-4332](https://cve.now/CVE-2024-4332.md): Improper Authentication in Tripwire Enterprise 9.1.0 APIs (CVSS 9.3)
- [CVE-2024-0259](https://cve.now/CVE-2024-0259.md): Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04 (CVSS 7.3)
- [CVE-2024-25156](https://cve.now/CVE-2024-25156.md): Path traversal in GoAnywhere MFT 7.4.1 and Earlier (CVSS 6.5)
- [CVE-2024-25155](https://cve.now/CVE-2024-25155.md): Reflected Cross-Site Scripting (XSS) in FileCatalyst Direct 3.8.8 and earlier (CVSS 7.2)
- [CVE-2024-25154](https://cve.now/CVE-2024-25154.md): Path Traversal in FileCatalyst Direct 3.8.8 and Earlier (CVSS 5.3)
- [CVE-2024-25153](https://cve.now/CVE-2024-25153.md): Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114 (CVSS 9.8)
- [CVE-2024-0204](https://cve.now/CVE-2024-0204.md): Authentication Bypass in GoAnywhere MFT (CVSS 9.8)
- [CVE-2023-6253](https://cve.now/CVE-2023-6253.md): Saved Uninstall Key in Digital Guardian Agent Uninstaller (no CVSS)
- [CVE-2023-2991](https://cve.now/CVE-2023-2991.md): Fortra Globalscape Administration Server Information Disclosure (no CVSS)
- [CVE-2023-2990](https://cve.now/CVE-2023-2990.md): Fortra Globalscape Administration Server Denial of Service (no CVSS)
- [CVE-2023-2989](https://cve.now/CVE-2023-2989.md): Fortra Globalscape Administration Server Out of Bounds Memory Read (no CVSS)
- [CVE-2023-0669](https://cve.now/CVE-2023-0669.md): Fortra GoAnywhere MFT License Response Servlet Command Injection (CVSS 7.2, KEV)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/fortra
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.