Fortra GoAnywhere MFT and GoAnywhere Agents Static IV Vulnerability Allowing Brute-Force Decryption

A vulnerability exists in Fortra's GoAnywhere MFT versions prior to 7.10.0 and GoAnywhere Agents versions prior to 2.2.0, where encrypted values use a static initialization vector (IV). This flaw enables admin users to brute-force the decryption of data.

Impact

Exploitation of this vulnerability could lead to unauthorized decryption of sensitive data, potentially allowing for data exposure or misuse.

Remediation

Users are advised to update to Fortra GoAnywhere MFT version 7.10.0 or later, and GoAnywhere Agents version 2.2.0 or later.