CVE-2026-1089: User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups
User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortra GoAnywhere MFTto a version that resolves this vulnerability.Fixed in 7.10.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1089?
CVE-2026-1089 is considered a moderate severity vulnerability that allows for user-controlled DNS lookups.
How do I fix CVE-2026-1089?
To mitigate CVE-2026-1089, upgrade Fortra's GoAnywhere MFT to version 7.10.0 or later.
What are the main risks associated with CVE-2026-1089?
The main risks of CVE-2026-1089 include potential DNS rebinding attacks and unauthorized information disclosure.
Which versions of Fortra GoAnywhere MFT are affected by CVE-2026-1089?
CVE-2026-1089 affects Fortra GoAnywhere MFT versions prior to 7.10.0.
Who is impacted by CVE-2026-1089?
Organizations using affected versions of Fortra's GoAnywhere MFT are impacted by CVE-2026-1089.