{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Fortra vulnerabilities","home_page_url":"https://patchfirst.co/vendor/fortra/","feed_url":"https://patchfirst.co/feed/vendor/fortra.json","description":"New and newly exploited Fortra CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-79898","url":"https://patchfirst.co/cve/CVE-2026-79898/","title":"CVE-2026-79898: Fortra BoKS Manager contains a command injection vulnerability in crlserver","content_text":"Fortra · BoKS Manager. Not in CISA KEV. EPSS 1.0% (higher than 62.6% of CVEs). CVSS 9.1 CRITICAL. Priority 20.5 of 100.","summary":"Fortra BoKS Manager contains a command injection vulnerability in crlserver","date_published":"2026-10-01T00:00:00.000Z","date_modified":"2026-10-01T20:34:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":20.5,"kev":null,"epss":{"score":0.00995,"percentile":0.62621},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortra","product":"BoKS Manager","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-12627","url":"https://patchfirst.co/cve/CVE-2026-12627/","title":"CVE-2026-12627: Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in…","content_text":"Fortra · Fortra's Core Privileged Access Manager (BoKS). Not in CISA KEV. EPSS 0.4% (higher than 39.1% of CVEs). CVSS 9.8 CRITICAL. Priority 16.3 of 100.","summary":"Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in…","date_published":"2026-10-01T00:00:00.000Z","date_modified":"2026-10-01T20:34:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.3,"kev":null,"epss":{"score":0.0045,"percentile":0.391},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortra","product":"Fortra's Core Privileged Access Manager (BoKS)","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-79901","url":"https://patchfirst.co/cve/CVE-2026-79901/","title":"CVE-2026-79901: In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory…","content_text":"Fortra · BoKS Manager boks-server. Not in CISA KEV. EPSS 0.3% (higher than 19.4% of CVEs). CVSS 9.9 CRITICAL. Priority 12.4 of 100.","summary":"In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory…","date_published":"2026-10-01T00:00:00.000Z","date_modified":"2026-10-01T15:17:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":12.4,"kev":null,"epss":{"score":0.00271,"percentile":0.19358},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortra","product":"BoKS Manager boks-server","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2025-10035#kev","url":"https://patchfirst.co/cve/CVE-2025-10035/","title":"[KEV] CVE-2025-10035: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability","content_text":"Fortra · GoAnywhere MFT. In CISA KEV since 2025-09-29, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 83.7 of 100.","summary":"Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability","date_published":"2025-09-29T00:00:00.000Z","date_modified":"2026-10-18T21:10:00.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2025-09-29","ransomware":true},"epss":{"score":0.99823,"percentile":0.9996},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortra","product":"GoAnywhere MFT","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-5276","url":"https://patchfirst.co/cve/CVE-2024-5276/","title":"CVE-2024-5276: SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)","content_text":"Fortra · FileCatalyst Workflow. Not in CISA KEV. EPSS 90.1% (higher than 99.79% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 66.8 of 100.","summary":"SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)","date_published":"2024-06-25T00:00:00.000Z","date_modified":"2024-08-01T21:11:12.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":66.8,"kev":null,"epss":{"score":0.90067,"percentile":0.99794},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortra","product":"FileCatalyst Workflow","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-0204","url":"https://patchfirst.co/cve/CVE-2024-0204/","title":"CVE-2024-0204: Authentication Bypass in GoAnywhere MFT","content_text":"Fortra · GoAnywhere MFT. Not in CISA KEV. EPSS 95.1% (higher than 99.86% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 69.4 of 100.","summary":"Authentication Bypass in GoAnywhere MFT","date_published":"2024-01-22T00:00:00.000Z","date_modified":"2025-05-30T14:22:31.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":69.4,"kev":null,"epss":{"score":0.95086,"percentile":0.99862},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortra","product":"GoAnywhere MFT","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-39197#kev","url":"https://patchfirst.co/cve/CVE-2022-39197/","title":"[KEV] CVE-2022-39197: Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability","content_text":"Fortra · Cobalt Strike. In CISA KEV since 2023-03-30. ENISA EUVD lists it as exploited. EPSS 44.1% (higher than 98.8% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 70.9 of 100.","summary":"Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability","date_published":"2023-03-30T00:00:00.000Z","date_modified":"2026-06-17T04:57:53.000Z","tags":["kev","public-exploit","T1059"],"_patchfirst":{"reason":"kev","priority":70.9,"kev":{"dateAdded":"2023-03-30","ransomware":false},"epss":{"score":0.44145,"percentile":0.98753},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Fortra","product":"Cobalt Strike","techniqueIds":["T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-42948#kev","url":"https://patchfirst.co/cve/CVE-2022-42948/","title":"[KEV] CVE-2022-42948: Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability","content_text":"Fortra · Cobalt Strike. In CISA KEV since 2023-03-30. ENISA EUVD lists it as exploited. EPSS 2.7% (higher than 85.9% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 62.0 of 100.","summary":"Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability","date_published":"2023-03-30T00:00:00.000Z","date_modified":"2026-06-17T05:05:39.000Z","tags":["kev","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":62,"kev":{"dateAdded":"2023-03-30","ransomware":false},"epss":{"score":0.02706,"percentile":0.85945},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortra","product":"Cobalt Strike","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-0669#kev","url":"https://patchfirst.co/cve/CVE-2023-0669/","title":"[KEV] CVE-2023-0669: Fortra GoAnywhere MFT Remote Code Execution Vulnerability","content_text":"Fortra · GoAnywhere MFT. In CISA KEV since 2023-02-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1210 Exploitation of Remote Services; T1486 Data Encrypted for Impact. Priority 78.0 of 100.","summary":"Fortra GoAnywhere MFT Remote Code Execution Vulnerability","date_published":"2023-02-10T00:00:00.000Z","date_modified":"2026-08-06T05:16:38.000Z","tags":["kev","ransomware","public-exploit","T1190","T1210","T1486"],"_patchfirst":{"reason":"kev","priority":78,"kev":{"dateAdded":"2023-02-10","ransomware":true},"epss":{"score":0.99999,"percentile":0.99996},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Fortra","product":"GoAnywhere MFT","techniqueIds":["T1190","T1210","T1486"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}