Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Fortra — Vulnerabilities & Security Advisories 47

Browse all 47 CVE security advisories affecting Fortra. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Fortra, formerly part of DigiCert, specializes in identity governance and privileged access management solutions, primarily serving enterprise environments requiring strict control over administrative credentials. The company’s software portfolio has historically been associated with a significant volume of security flaws, currently totaling 34 Common Vulnerabilities and Exposures (CVEs). These vulnerabilities predominantly involve remote code execution and cross-site scripting, often stemming from insufficient input validation or improper access controls within web-based administrative interfaces. While specific major public breaches directly attributed to Fortra products remain limited in widespread reporting, the high count of disclosed CVEs indicates persistent challenges in securing legacy codebases and complex privilege escalation mechanisms. Security analysts recommend rigorous patch management and network segmentation to mitigate risks associated with these known weaknesses, ensuring that privileged access tools do not become entry points for broader infrastructure compromise.

CVE ID Title CVSS Severity Published
CVE-2026-14316 Heap buffer overflow in boks_sshd revoked-key error handling — Core Privileged Access Manager (BoKS) CWE-122 8.1 High 2026-10-01
CVE-2026-9864 Fortra BoKS Server Agent adjoin machine-account password generation vulnerability — Core Privileged Access Manager (BoKS) CWE-338 4.8 Medium 2026-10-01
CVE-2026-12627 Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability — Fortra's Core Privileged Access Manager (BoKS) CWE-121 9.8 Critical 2026-10-01
CVE-2026-79896 Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability — BoKS Manager CWE-125 7.5 High 2026-10-01
CVE-2026-79898 Fortra BoKS Manager crlserver command injection vulnerability — BoKS Manager CWE-78 9.1 Critical 2026-10-01
CVE-2026-79899 Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability — BoKS Manager CWE-377 7.9 High 2026-10-01
CVE-2026-79900 Heap overflow in KSL checksum initialization — BoKS Manager boks-server CWE-787 6.5 Medium 2026-10-01
CVE-2026-79901 Predictable Active Directory service-account passwords in BoKS Manager — BoKS Manager boks-server CWE-338 9.9 Critical 2026-10-01
CVE-2026-15913 Path Traversal in Fortra's GoAnywhere MFT Endpoint — GoAnywhere MFT CWE-23 7.7 High 2026-09-09
CVE-2026-12164 Privilege Escalation in Fortra File Integrity Monitoring (FIM) — File Integrity Monitoring (FIM) CWE-266 4.4 Medium 2026-06-23
CVE-2026-12163 Stored XSS in Fortra File Integrity Monitoring (FIM) — File Integrity Monitoring (FIM) CWE-79 5.5 Medium 2026-06-23
CVE-2026-9863 Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability — Core Privileged Access Manager (BoKS) CWE-78 7.5 High 2026-06-15
CVE-2026-9862 Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability — Core Privileged Access Manager (BoKS) CWE-78 9.8 Critical 2026-06-15
CVE-2026-1089 User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups — GoAnywhere MFT CWE-74 6.5 Medium 2026-04-21
CVE-2026-0972 HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT — GoAnywhere MFT CWE-74 5.4 Medium 2026-04-21
CVE-2026-0971 GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout — GoAnywhere MFT CWE-613 4.3 Medium 2026-04-21
CVE-2025-14362 GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances — GoAnywhere MFT CWE-307 7.3 High 2026-04-21
CVE-2025-1241 Encryption vulnerable to brute-force decryption in GoAnywhere MFT — GoAnywhere MFT CWE-326 5.8 Medium 2026-04-21
CVE-2025-13532 Weak Password Hash in Core Privileged Access Manager (BoKS) — Core Privileged Access Manager (BoKS) CWE-916 6.2 Medium 2025-12-16
CVE-2025-8148 CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT — GoAnywhere MFT CWE-732 4.2 Medium 2025-12-05
CVE-2025-10035 Deserialization Vulnerability in GoAnywhere MFT's License Servlet — GoAnywhere MFT CWE-77 10.0 Critical 2025-09-18
CVE-2025-8450 Unrestricted File Upload in FileCatalyst — FileCatalyst CWE-434 8.2 High 2025-08-19
CVE-2025-3871 Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier — GoAnywhere MFT CWE-862 5.3 Medium 2025-07-16
CVE-2025-5141 Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache — Core Privileged Access Manager (BoKS) CWE-524 5.5 Medium 2025-06-17
CVE-2024-11922 Input Validation vulnerability in Web Client emails that do not go through Secure Mail — GoAnywhere MFT CWE-79 6.3 Medium 2025-04-28
CVE-2025-0049 Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0 — GoAnywhere CWE-209 3.5 Low 2025-04-28
CVE-2024-11923 Sensitive Information Disclosure in Fortra Application Hub Prior to version 1.3 — Fortra Application Hub CWE-532 5.5 Medium 2025-01-17
CVE-2024-9945 Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0 — GoAnywhere MFT CWE-200 5.3 Medium 2024-12-13
CVE-2024-3334 USB Security Feature Bypass in Digital Guardian Windows Agent Prior to version 8.2.0 — Digital Guardian Agent CWE-922 4.3 Medium 2024-11-15
CVE-2024-8264 Sensitive information in agent log file when detailed logging is enabled with Robot Schedule Enterprise prior to version 3.05 — Robot Schedule Enterprise CWE-532 5.5 Medium 2024-10-09

This page lists every published CVE security advisory associated with Fortra. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.