Fortra

Latest CVEs · RSS

• CVE-2026-14316 2026-10-01 · CVSS 8.1
  The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted
• CVE-2026-9864 2026-10-01 · CVSS 4.8
  Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Direc
• CVE-2026-12627 2026-10-01 · CVSS 9.8
  Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access
• CVE-2026-79896 2026-10-01 · CVSS 7.5
  Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker ca
• CVE-2026-79898 2026-10-01 · CVSS 9.1
  Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP
• CVE-2026-79899 2026-10-01 · CVSS 7.9
  Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a
• CVE-2026-79900 2026-10-01 · CVSS 6.5
  boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the dige
• CVE-2026-79901 2026-10-01 · CVSS 9.9
  In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-ra
• CVE-2026-15913 2026-09-09 · CVSS 7.7
  In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folde
• CVE-2026-12164 2026-06-23 · CVSS 4.4
  Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users cr
• CVE-2026-12163 2026-06-23 · CVSS 5.5
  Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the
• CVE-2026-9863 2026-06-15 · CVSS 7.5
  Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A maliciou
• CVE-2026-9862 2026-06-15 · CVSS 9.8
  Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network
• CVE-2026-1089 2026-04-21 · CVSS 6.5
  User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Informatio
• CVE-2026-0972 2026-04-21 · CVSS 5.4
  HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were c
• CVE-2026-0971 2026-04-21 · CVSS 4.3
  An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login
• CVE-2025-14362 2026-04-21 · CVSS 7.3
  The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to lo
• CVE-2025-1241 2026-04-21 · CVSS 5.8
  Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to
• CVE-2026-2636 2026-02-25 · CVSS 5.5
  This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads to an unrecoverable inconsistency in the
• CVE-2025-13532 2025-12-16 · CVSS 6.2
  Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms.
• CVE-2025-8148 2025-12-05 · CVSS 4.2
  An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH k
• CVE-2025-10035 2025-09-18 · CVSS 10.0
  A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserializ
• CVE-2025-8450 2025-08-19 · CVSS 8.2
  Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page
• CVE-2025-3871 2025-07-16 · CVSS 5.3
  Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One
• CVE-2025-5141 2025-06-17 · CVSS 5.5
  A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1