Vendor

Fortra

4 of 9 Fortra CVEs in Patchfirst (44%) are in of vulnerabilities exploited in the wild, 2 of them used by ransomware.

CVEs: 9
In CISA KEV: 444%
Known ransomware use: 2
Median days to KEV: 8; from publication
Latest KEV listing: 29 Sep 2025

Watch Fortra Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
GoAnywhere MFT In KEV: 2 CVEs: 3
Cobalt Strike In KEV: 2 CVEs: 2
BoKS Manager In KEV: 0 CVEs: 1
BoKS Manager boks-server In KEV: 0 CVEs: 1
FileCatalyst Workflow In KEV: 0 CVEs: 1
Fortra's Core Privileged Access Manager (BoKS) In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with Fortra CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 3
T1059Command and Scripting Interpreter CVEs: 3
T1210Exploitation of Remote Services CVEs: 1
T1486Data Encrypted for Impact CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/fortra.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are Fortra CVEs linked to the technique. Each link’s provenance is on the CVE page.

Fortra CVEs

9 CVEs, by priority

CVE-2025-10035Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
Fortra · GoAnywhere MFTKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
99.8%Top 0.04%
83.7priority
CVE-2023-0669Fortra GoAnywhere MFT Remote Code Execution Vulnerability
Fortra · GoAnywhere MFTKEVRansomwarePublic exploitHigh · 7.2T1190Exploit Public-Facing Application T1210Exploitation of Remote Services+1 more
>99.9%Top 0.01%
78.0priority
CVE-2022-39197Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
Fortra · Cobalt StrikeKEVPublic exploitMedium · 6.1T1059Command and Scripting Interpreter1 report
44.1%Top 1.2%
70.9priority
CVE-2024-0204Authentication Bypass in GoAnywhere MFT
Fortra · GoAnywhere MFTPublic exploitCritical · 9.8
95.1%Top 0.14%
69.4priority
CVE-2024-5276SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)
Fortra · FileCatalyst WorkflowPublic exploitCritical · 9.8
90.1%Top 0.21%
66.8priority
CVE-2022-42948Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability
Fortra · Cobalt StrikeKEVCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
2.7%Top 14%
62.0priority
CVE-2026-79898Fortra BoKS Manager contains a command injection vulnerability in crlserver
Fortra · BoKS ManagerCritical · 9.1
1.0%Top 37%
20.5priority
CVE-2026-12627Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in…
Fortra · Fortra's Core Privileged Access Manager (BoKS)Critical · 9.8
0.4%Top 61%
16.3priority
CVE-2026-79901In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory…
Fortra · BoKS Manager boks-serverCritical · 9.9
0.3%Top 81%
12.4priority