CVE-2026-1089: Fortra GoAnywhere Managed File Transfer

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.

Affected products

• Fortra GoAnywhere Managed File Transfer: before 7.10.0 (fixed in 7.10.0)

Published 2026-04-21. Last modified 2026-06-17.