PT-2026-33974 · Fortra · Goanywhere Mft+1

Published 2026-04-21 · Updated 2026-04-21 · CVE-2025-1241

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GoAnywhere MFT versions prior to 7.10.0 GoAnywhere Agents versions prior to 2.2.0

Description Encrypted values utilize a static IV (Initialization Vector), which is a fixed starting value used in encryption to ensure that the same plaintext encrypts to different ciphertexts. This allows admin users to brute-force the decryption of data.

Recommendations Update GoAnywhere MFT to version 7.10.0 or later. Update GoAnywhere Agents to version 2.2.0 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2025-1241

Affected Products

Goanywhere Agents

Goanywhere Mft

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-1241 · Security Note
• https://fortra.com/security/advisories/product-security/FI-2026-001 · Vendor Advisory
• https://twitter.com/CVEnew/status/2046601496813244919 · Twitter Post