CVE-2025-14362CWE-307

CVE-2025-14362

High · published April 21, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
8.6
In the wild
Unconfirmed
What it is

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00194 · 8.6th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-04-21T19:16Z
Affected products (1)
ProductVersionsFixed in
fortra/goanywhere_managed_file_transfer< 7.10.07.10.0
References (1)
https://fortra.com/security/advisories/product-security/FI-2026-002 · df4dee71-de3a-4139-9588-11b62fe6c0ff
EPSS history
Timeline
  • 21 APR 14:14Z
    GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances
    cvelistv5