Fortra vulnerabilities
We track 22 vulnerabilities in Fortra products across 14 products. 22 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on October 1, 2026.
Latest Fortra vulnerabilities
- 8.1 High severity
Core Privileged Access Manager (BoKS): Heap-based Buffer Overflow
The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.
- 7.5 High severity
BoKS Manager: Out-of-bounds Read
Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normally restart
- 9.8 Critical severity
Fortra's Core Privileged Access Manager (BoKS): Stack-based Buffer Overflow
Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response pro
- 7.9 High severity
Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert.
Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to
- 9.1 Critical severity
BoKS Manager: Improper Neutralization of Special Elements used in an OS Command
Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by c
- 9.9 Critical severity
BoKS Manager boks-server: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal an
- 7.7 High severity
GoAnywhere MFT: Relative Path Traversal
In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file re
- 8.8 High severity
Core Privileged Access Manager (BoKS): Improper Neutralization of Special Elements used in an OS Command
Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause c
- 9.8 Critical severity
Core Privileged Access Manager (BoKS): Improper Neutralization of Special Elements used in an OS Command
Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the servic
- 7.3 High severity
GoAnywhere MFT: Improper Restriction of Excessive Authentication Attempts
The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.
- 9.8 Critical severity
Fortra GoAnywhere MFT Deserialization of Untrusted Data Exploited
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
- 8.2 High severity
FileCatalyst: Missing Authentication for Critical Functionality
Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page.
- 9.8 Critical severity
FileCatalyst Workflow: Use of Hard-coded Credentials
The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credentials could lead to a compromise of confidentiality, integrity, or availability of the software. The H
- 7.2 High severity
FileCatalyst Workflow: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability exists in FileCatalyst Workflow whereby a field accessible to the super admin can be used to perform an SQL injection attack which can lead to a loss of confidentiality, integrity, and availability.
- 9.1 Critical severity
FileCatalyst Workflow: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL inj
- 7.8 High severity
FileCatalyst Direct: Use of Hard-coded Password
A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be read out, for example, the private key for certificates. Exploit of this vulnerability could lead to a machine-in-the-middl
- 9.3 Critical severity
Tripwire Enterprise: Incorrect Implementation of Authentication Algorithm
An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Gr
- 7.3 High severity
Robot Schedule Enterprise Agent: Incorrect Default Permissions
Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges,
- 9.8 Critical severity
FileCatalyst: Exposure of Resource to Wrong Sphere
A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web p
- 7.5 High severity
Globalscape EFT: Uncontrolled Recursion
Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause infinite recursion and crash the service
- 9.1 Critical severity
Globalscape EFT: Out-of-bounds Read
Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash the service or bypass authentication if successfully exploited
- 7.2 High severity
Fortra GoAnywhere MFT Remote Code Execution Exploited
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.