CVE-2025-1241

MEDIUM

Encryption vulnerable to brute-force decryption in GoAnywhere MFT

Title source: cna

Description

Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.

References (1)

https://fortra.com/security/advisories/product-security/FI-2026-001

Scores

CVSS v3 5.8

EPSS 0.0002

EPSS Percentile 4.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-326

Status published

Products (3)

Fortra/GoAnywhere MFT < 7.10.0

fortra/goanywhere_agents < 2.2.0

fortra/goanywhere_managed_file_transfer < 7.10.0

Published Apr 21, 2026

Tracked Since Apr 21, 2026