CVE-2025-14362

Published: Apr 21, 2026Modified: Jun 17, 2026

7.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: df4dee71-de3a-4139-9588-11b62fe6c0ff (Secondary)

Description

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.

Affected (1)

Products: Fortra: Goanywhere Managed File Transfer

Fortra

1 product

Goanywhere Managed File Transfer

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fortra Goanywhere Managed File Transfer	Before 7.10.0

Related CWEs

CWE-307

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (1)

https://fortra.com/security/advisories/product-security/FI-2026-002

Source: df4dee71-de3a-4139-9588-11b62fe6c0ff

Vendor Advisory

Timeline

No history available yet.