CVE-2023-0669: Fortra GoAnywhere MFT Remote Code Execution Vulnerability

High severity, CVSS 7.2. Actively exploited: in CISA KEV since 2023-02-10. EPSS: 100% chance of exploitation in the next 30 days.

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

Affected products

• Fortra GoAnywhere Managed File Transfer: before 7.1.2 (fixed in 7.1.2)

Published 2023-02-06. Last modified 2026-08-06.