CVE-2026-0971

Published: Apr 21, 2026Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: df4dee71-de3a-4139-9588-11b62fe6c0ff (Secondary)

Description

An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.

Affected (1)

Products: Fortra: Goanywhere Managed File Transfer

Fortra

1 product

Goanywhere Managed File Transfer

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fortra Goanywhere Managed File Transfer	Before 7.10.0

Related CWEs

CWE-613

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (1)

https://fortra.com/security/advisories/product-security/fi-2025-013

Source: df4dee71-de3a-4139-9588-11b62fe6c0ff

Not Applicable

Timeline

No history available yet.