CVE-2025-1241

Published: Apr 21, 2026Modified: Jun 17, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.

Affected (2)

Products: Fortra: Goanywhere Agents, Goanywhere Managed File Transfer

Fortra

2 products

Goanywhere Agents

Goanywhere Managed File Transfer

Configuration A

2 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Fortra Goanywhere Agents	Before 2.2.0
Fortra Goanywhere Managed File Transfer	Before 7.10.0

Running on/with	Platform Versions
Apple Macos	All versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions

Related CWEs

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (1)

https://fortra.com/security/advisories/product-security/FI-2026-001

Source: df4dee71-de3a-4139-9588-11b62fe6c0ff

Vendor Advisory

Timeline

No history available yet.