CVE-2025-3871
Medium
Description
Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP.
SeverityMedium
CVSS5.3
Exploit probability—
ProductGoAnywhere MFT
PublishedJul 16, 2025
First seenJul 16, 2025
Weakness typeCWE-862Missing authorization
How to fix
Update
- Fortra GoAnywhere MFT7.8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Fortra GoAnywhere MFT | v < 7.8.1 | 7.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.