CVE-2023-0669
High 7.2 Exploited in the wild (KEV) Used in ransomware campaigns
Confirmed active exploitation — CISA KEV catalog
- Name
- Fortra GoAnywhere MFT Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
Metrics
- CVSS 3.1
-
7.2 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% (percentile: 100) as of 2 November 2026
- CWE
- CWE-502
Affected products
fortra: goanywhere managed file transfer
References
- https://github.com/rapid7/metasploit-framework/pull/17607 Patch
- https://github.com/rapid7/metasploit-framework/pull/17607 Patch
- http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-… ExploitThird Party AdvisoryVDB Entry
- https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis ExploitThird Party Advisory
- https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html ExploitThird Party Advisory
- http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-… ExploitThird Party AdvisoryVDB Entry
- https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis ExploitThird Party Advisory
- https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html ExploitThird Party Advisory
- https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhe… Broken LinkThird Party Advisory
- https://infosec.exchange/@briankrebs/109795710941843934 MitigationThird Party Advisory