FO
Vendor
Fortra
50
CVEs
6
On KEV
8
New 30D
Products
BM9.1
BoKS Manager
Fortra
3 CVEs0 on KEV3 new
CP9.8
Core Privileged Access Manager (BoKS)
Fortra
4 CVEs0 on KEV2 new
BM9.9
BoKS Manager boks-server
Fortra
2 CVEs0 on KEV2 new
FC9.8
Fortra's Core Privileged Access Manager (BoKS)
Fortra
1 CVEs0 on KEV1 new
GM9.8
Goanywhere Managed File Transfer
Fortra
13 CVEs2 on KEV0 new
GM9.8
GoAnywhere MFT
File Transfer
8 CVEs2 on KEV0 new
CS9.8
Cobalt Strike
Fortra
2 CVEs2 on KEV0 new
FW9.8
Filecatalyst Workflow
Fortra
4 CVEs0 on KEV0 new
CP9.8
Core Privileged Access Manager Server
Fortra
2 CVEs0 on KEV0 new
FI4.8
File Integrity Monitoring
Fortra
2 CVEs0 on KEV0 new
FI4.8
File Integrity Monitoring (FIM)
Fortra
2 CVEs0 on KEV0 new
FD6.1
Filecatalyst Direct
Fortra
2 CVEs0 on KEV0 new
RS7.3
Robot Schedule
Fortra
2 CVEs0 on KEV0 new
DE9.8
Delivernow
Fortra
1 CVEs0 on KEV0 new
DG6.0
Digital Guardian Agent
Fortra
1 CVEs0 on KEV0 new
GA4.9
Goanywhere Agents
Fortra
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-14316 | CP Core Privileged Access Manager (BoKS) Fortra | 8.1 | Oct 1 | Heap buffer overflow in boks_sshd revoked-key error handling |
| CVE-2026-9864 | CP Core Privileged Access Manager (BoKS) Fortra | 4.8 | Oct 1 | Fortra BoKS Server Agent adjoin machine-account password generation vulnerability |
| CVE-2026-12627 | FC Fortra's Core Privileged Access Manager (BoKS) Fortra | 9.8 | Oct 1 | Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability |
| CVE-2026-79896 | BM BoKS Manager Fortra | 7.5 | Oct 1 | Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability |
| CVE-2026-79898 | BM BoKS Manager Fortra | 9.1 | Oct 1 | Fortra BoKS Manager crlserver command injection vulnerability |
| CVE-2026-79899 | BM BoKS Manager Fortra | 7.9 | Oct 1 | Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability |
| CVE-2026-79900 | BM BoKS Manager boks-server Fortra | 6.5 | Oct 1 | Heap overflow in KSL checksum initialization |
| CVE-2026-79901 | BM BoKS Manager boks-server Fortra | 9.9 | Oct 1 | Predictable Active Directory service-account passwords in BoKS Manager |
| CVE-2026-15913 | GM GoAnywhere MFT Fortra | 7.7 | Sep 9 | Path Traversal in Fortra's GoAnywhere MFT Endpoint |
| CVE-2026-12164 | FI File Integrity Monitoring (FIM) Fortra | 4.4 | Jun 23 | Privilege Escalation in Fortra File Integrity Monitoring (FIM) |
| CVE-2026-12163 | FI File Integrity Monitoring (FIM) Fortra | 4.8 | Jun 23 | Stored XSS in Fortra File Integrity Monitoring (FIM) |
| CVE-2026-9863 | CP Core Privileged Access Manager (BoKS) Fortra | 8.8 | Jun 15 | Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability |
| CVE-2026-9862 | CP Core Privileged Access Manager (BoKS) Fortra | 9.8 | Jun 15 | Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability |
| CVE-2026-1089 | GM GoAnywhere MFT Fortra | 6.5 | Apr 21 | User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups |
| CVE-2026-0972 | GM GoAnywhere MFT Fortra | 5.4 | Apr 21 | HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT |
| CVE-2026-0971 | GM GoAnywhere MFT Fortra | 4.3 | Apr 21 | GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout |
| CVE-2025-14362 | GM GoAnywhere MFT Fortra | 7.3 | Apr 21 | GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances |
| CVE-2025-1241 | GM GoAnywhere MFT Fortra | 4.9 | Apr 21 | Encryption vulnerable to brute-force decryption in GoAnywhere MFT |
| CVE-2025-8148 | GM Goanywhere Managed File Transfer Fortra | 4.2 | Dec 5 | An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to… |
| CVE-2025-10035 RansomwareIn wildKEV | GM GoAnywhere MFT Fortra | 9.8 | Sep 18 | Deserialization Vulnerability in GoAnywhere MFT's License Servlet |
| CVE-2025-0049 | GM Goanywhere Managed File Transfer Fortra | 4.3 | Apr 28 | When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may… |
| CVE-2024-11922 | GM Goanywhere Managed File Transfer Fortra | 5.4 | Apr 28 | Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert… |
| CVE-2024-8264 | RS Robot Schedule Fortra | 5.5 | Oct 9 | Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enabled |
| CVE-2024-6633 | FW Filecatalyst Workflow Fortra | 9.8 | Aug 27 | The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article |
| CVE-2024-6632 | FW Filecatalyst Workflow Fortra | 7.2 | Aug 27 | A vulnerability exists in FileCatalyst Workflow whereby a field accessible to the super admin can be used to perform an SQL injection attack which can lead to a loss of… |
| CVE-2024-25157 | GM Goanywhere Managed File Transfer Fortra | 6.5 | Aug 14 | An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to… |
| CVE-2024-5276 | FW Filecatalyst Workflow Fortra | 9.1 | Jun 25 | A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion… |
| CVE-2024-0259 | RS Robot Schedule Fortra | 7.3 | Mar 28 | Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation |
| CVE-2024-25156 | GM Goanywhere Managed File Transfer Fortra | 6.5 | Mar 14 | A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web… |
| CVE-2024-25155 | FD Filecatalyst Direct Fortra | 6.1 | Mar 13 | In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page |
| CVE-2024-25154 | FD Filecatalyst Direct Fortra | 5.3 | Mar 13 | Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the… |
| CVE-2024-25153 | FW Filecatalyst Workflow Fortra | 9.8 | Mar 13 | A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially… |
| CVE-2024-0204 | GM Goanywhere Managed File Transfer Fortra | 9.8 | Jan 22 | Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal |
| CVE-2023-6253 | DG Digital Guardian Agent Fortra | 6.0 | Nov 22 | A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by… |
| CVE-2021-26837 | DE Delivernow Fortra | 9.8 | Sep 19 | SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers to execute arbitrary code, escalate… |
| CVE-2022-42948 In wildKEV | CS Cobalt Strike Fortra | 9.8 | Mar 24 | Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability |
| CVE-2023-0669 RansomwareIn wildKEV | GM GoAnywhere MFT Fortra | 7.2 | Feb 6 | Fortra GoAnywhere MFT License Response Servlet Command Injection |
| CVE-2022-39197 In wildKEV | CS Cobalt Strike Fortra | 6.1 | Sep 22 | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability |