CVE-2026-1089

Published: Apr 21, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Exploitability: 3.9 / Impact: 2.5

Source: df4dee71-de3a-4139-9588-11b62fe6c0ff (Secondary)

Description

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.

Affected (1)

Products: Fortra: Goanywhere Managed File Transfer

Fortra

1 product

Goanywhere Managed File Transfer

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fortra Goanywhere Managed File Transfer	Before 7.10.0

Related CWEs

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (1)

https://www.fortra.com/security/advisories/product-security/fi-2026-005

Source: df4dee71-de3a-4139-9588-11b62fe6c0ff

Vendor Advisory

Timeline

No history available yet.