CVE-2025-14362

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://fortra.com/security/advisories/product-security/FI-2026-002	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El límite de intentos de inicio de sesión no se aplica en el servicio SFTP de GoAnywhere MFT de Fortra anterior a la versión 7.10.0 si el usuario web al que se intenta iniciar sesión está configurado para iniciar sesión con una clave SSH, lo que hace que la clave SSH sea vulnerable a ser adivinada mediante fuerza bruta.

Information

Published : 2026-04-21 15:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-14362

Mitre link : CVE-2025-14362

CVE.ORG link : CVE-2025-14362

JSON object : View

Products Affected

fortra

goanywhere_managed_file_transfer

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2025-14362", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14362", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T19:33:27.357827Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "affectedData": [{"vendor": "Fortra", "product": "GoAnywhere MFT", "versions": [{"status": "affected", "version": "0", "lessThan": "7.10.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-21T15:16:35.207", "references": [{"url": "https://fortra.com/security/advisories/product-security/FI-2026-002", "tags": ["Vendor Advisory"], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "The login limit is not enforced on the\u00a0SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force."}, {"lang": "es", "value": "El l\u00edmite de intentos de inicio de sesi\u00f3n no se aplica en el servicio SFTP de GoAnywhere MFT de Fortra anterior a la versi\u00f3n 7.10.0 si el usuario web al que se intenta iniciar sesi\u00f3n est\u00e1 configurado para iniciar sesi\u00f3n con una clave SSH, lo que hace que la clave SSH sea vulnerable a ser adivinada mediante fuerza bruta."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EB6422D-7B12-41B3-BD42-5610C6C72524", "versionEndExcluding": "7.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}