CVE-2026-0972: HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT
HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0.
Note: The title, details, and description of this CVE were corrected post-publishing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortra GoAnywhere MFTto a version that resolves this vulnerability.Fixed in 7.10.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0972?
CVE-2026-0972 has a high severity rating due to the ease of performing brute force attacks on the SFTP service.
How do I fix CVE-2026-0972?
To fix CVE-2026-0972, upgrade Fortra's GoAnywhere MFT to version 7.10.0 or later.
What type of attack is related to CVE-2026-0972?
CVE-2026-0972 is associated with brute force attacks on the SFTP login service.
Which versions of GoAnywhere MFT are affected by CVE-2026-0972?
CVE-2026-0972 affects all versions of Fortra's GoAnywhere MFT prior to 7.10.0.
Is the SSH key configuration relevant to CVE-2026-0972?
Yes, CVE-2026-0972 specifically impacts the SFTP service when the user is configured to log in with an SSH key, as it does not enforce the login attempt limit.