Fortra
36 CVEs across 23 Fortra products. Browse Fortra vulnerabilities, severities, and proof-of-concept exploits.
Fortra products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12164 | Medium | 4.4 | 2026-06-23 | Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users c… |
CVE-2026-12163 | Medium | 5.5 | 2026-06-23 | Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in th… |
CVE-2026-9863 | High | 7.5 | 2026-06-15 | Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicio… |
CVE-2026-9862 | Critical | 9.8 | 2026-06-15 | Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with networ… |
CVE-2026-1089 | Medium | 6.5 | 2026-04-21 | User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Informati… |
CVE-2026-0972 | Medium | 5.4 | 2026-04-21 | HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were… |
CVE-2026-0971 | Medium | 4.3 | 2026-04-21 | An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login… |
CVE-2025-1241 | Medium | 5.8 | 2026-04-21 | Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users t… |
CVE-2025-14362 | High | 7.3 | 2026-04-21 | The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to l… |
CVE-2025-13532 | Medium | 6.2 | 2025-12-16 | Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms… |
CVE-2025-8148 | Medium | 4.2 | 2025-12-05 | An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH… |
CVE-2025-10035 | Critical | 10.0 | 2025-09-18 | A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deseriali… |
CVE-2025-8450 | High | 8.2 | 2025-08-19 | Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms pag… |
CVE-2025-3871 | Medium | 5.3 | 2025-07-16 | Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere On… |
CVE-2025-5141 | Medium | 5.5 | 2025-06-17 | A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1… |
CVE-2025-0049 | Low | 3.5 | 2025-04-28 | When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server p… |
CVE-2024-11922 | Medium | 6.3 | 2025-04-28 | Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emai… |
CVE-2024-11923 | Medium | 5.5 | 2025-01-18 | Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub (Formerly named Helpsystems One) prior to… |
CVE-2024-9945 | Medium | 5.3 | 2024-12-13 | An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in ce… |
CVE-2024-3334 | Medium | 4.3 | 2024-11-15 | A security bypass vulnerability exists in the Removable Media Encryption (RME)component of Digital Guardian Windows Agents prior to version 8.2.0. This allows… |
CVE-2024-8264 | Medium | 5.5 | 2024-10-09 | Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enab… |
CVE-2024-6633 | Critical | 9.8 | 2024-08-27 | The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credent… |
CVE-2024-6632 | High | 7.2 | 2024-08-27 | A vulnerability exists in FileCatalyst Workflow whereby a field accessible to the super admin can be used to perform an SQL injection attack which can lead to… |
CVE-2024-25157 | Medium | 6.5 | 2024-08-14 | An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission check… |
CVE-2024-5276 | Critical | 9.8 | 2024-06-25 | A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative… |
CVE-2024-5275 | High | 7.8 | 2024-06-18 | A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be read out, for example… |
CVE-2024-4332 | | 2024-06-03 | An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use L… | |
CVE-2024-0259 | High | 7.3 | 2024-03-28 | Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the serv… |
CVE-2024-25156 | Medium | 6.5 | 2024-03-14 | A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywh… |
CVE-2024-25155 | High | 7.2 | 2024-03-13 | In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subs… |
CVE-2024-25154 | Medium | 5.3 | 2024-03-13 | Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files lo… |
CVE-2024-25153 | Critical | 9.8 | 2024-03-13 | A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ director… |
CVE-2024-0204 | Critical | 9.8 | 2024-01-22 | Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. |
CVE-2023-6253 | Medium | 6.0 | 2023-11-22 | A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the… |
CVE-2021-26837 | Critical | 9.8 | 2023-09-19 | SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers to execute arbitrary… |
CVE-2023-2991 | Medium | 5.3 | 2023-06-22 | Fortra Globalscape EFT's administration server suffers from an information disclosure vulnerability where the serial number of the harddrive that Globalscape i… |
CVE-2023-2990 | High | 7.5 | 2023-06-22 | Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause… |
CVE-2023-2989 | Critical | 9.1 | 2023-06-22 | Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash t… |
CVE-2023-0669 | High | 7.2 | 2023-02-06 | Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserial… |