CVE-2025-1241: Fortra GoAnywhere Agents

Medium severity, CVSS 4.9. EPSS: 0.1% chance of exploitation in the next 30 days.

Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.

Affected products

• Fortra GoAnywhere Agents: before 2.2.0 (fixed in 2.2.0)
• Fortra GoAnywhere Managed File Transfer: before 7.10.0 (fixed in 7.10.0)

Published 2026-04-21. Last modified 2026-10-07.