PatchTheCVECVE-2025-14362: The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User
CVE-2025-14362 is a high-severity flaw (CVSS 7.3) affecting goanywhere managed file transfer. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.3 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 91%) |
| CISA exploited list | No |
| Weakness | CWE-307 |
| Published | 2026-04-21 |
| Last modified | 2026-10-07 |
Last updated 2026-10-07 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-14362?
goanywhere managed file transfer: upgrade to 7.10.0. Exact commands for each OS are on this page.
Is CVE-2025-14362 being exploited?
CVE-2025-14362 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-14362 affect?
CVE-2025-14362 affects goanywhere managed file transfer. Severity is high (CVSS 7.3). The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute F
How urgent is CVE-2025-14362?
Priority 33/100. High severity; Remotely exploitable, no login, no user action
Software pages
Fortra GoAnywhere vulnerabilities
Related CVEs
- CVE-2026-1089 MEDIUM 6.5 UPGRADE User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a D
- CVE-2026-0972 MEDIUM 5.4 UPGRADE HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The
- CVE-2026-0971 MEDIUM 4.3 UPGRADE An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configure
- CVE-2025-1241 MEDIUM 5.8 UPGRADE UPGRADE Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2