Fortra GoAnywhere MFT: SSH Key Brute Force Vulnerability Discovered
The National Vulnerability Database has detailed a critical flaw in Fortra’s GoAnywhere Managed File Transfer (MFT) solution. Specifically, versions prior to 7.10.0 fail to enforce login limits when a web user is configured for SSH Key authentication. This oversight allows attackers to brute-force SSH keys, bypassing intended security controls.
This vulnerability, flagged with a CVSS score of 7.3 (HIGH), stems from CWE-307, which relates to improper restriction of operations within the user’s authentication cycle. The lack of login throttling on SSH key-based authentication presents a direct pathway for unauthorized access if an attacker can guess the private key.
What This Means For You
- If your organization uses Fortra GoAnywhere MFT version prior to 7.10.0 and employs SSH key authentication for web users, you must patch to version 7.10.0 or later immediately. Review your access logs for any suspicious brute-force attempts targeting SSH keys.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Fortra GoAnywhere MFT SSH Key Brute Force Attempt - CVE-2025-14362
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2025-14362 | Vulnerability | CVE-2025-14362 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 21, 2026 at 18:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related Posts
CVE-2026-40565 — FreeScout is a free self-hosted help desk and shared
CVE-2026-40565 — FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs in...
BRIDGE:BREAK Flaws Plague Lantronix and Silex Serial-to-IP Converters
Forescout Research Vedere Labs has uncovered 22 critical vulnerabilities, collectively named BRIDGE:BREAK, impacting Lantronix and Silex serial-to-IP converters. These devices, crucial for bridging legacy serial...
CVE-2026-1089 — Information Disclosure
CVE-2026-1089 — User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and...