CVE-2025-1241CWE-326

CVE-2025-1241

Medium · published April 21, 2026

CVSS v3.1
5.8
EPSS
0%
Percentile
2.2
In the wild
Unconfirmed
What it is

Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00127 · 2.2th percentile
Weakness
CWE-326 · Inadequate Encryption Strength
Published
2026-04-21T19:16Z
Affected products (2)
ProductVersionsFixed in
fortra/goanywhere_agents< 2.2.02.2.0
fortra/goanywhere_managed_file_transfer< 7.10.07.10.0
References (1)
https://fortra.com/security/advisories/product-security/FI-2026-001 · df4dee71-de3a-4139-9588-11b62fe6c0ff
EPSS history
Timeline
  • 21 APR 14:10Z
    Encryption vulnerable to brute-force decryption in GoAnywhere MFT
    cvelistv5