Fortra GoAnywhere MFT: attackers can get in without a password
OFFICIAL NAME: Authentication Bypass in GoAnywhere MFT
WHAT IT IS · FILE TRANSFERIt holds files you swap with customers and partners, a common target for bulk data theft.
DO THIS FIRSTPatch it today and check it for files or accounts you do not recognize. Not sure if you use it? Send this page to your IT provider or security lead and ask.
TECHNICAL SUMMARY Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
WHY THIS VERDICT Attack attempts are confirmed, with no confirmed exploitation yet.
WHY IT RANKS HERE The product faces the internet or gives remote access. Ready-made attack tools are public. The first report is 20 days old.
- HIGHEST CONFIRMED RUNG
- TRIED
- CISA KEV
- NOT YET
- EXPLOIT CODE
- READY TO USE
How far has it climbed?
01 TALK
□ NO EVIDENCE YETNEWEST EVIDENCE NONE YETNo evidence yet.
SRC: NONE YET02 EXPOSED
□ NOT TRACKED YETNO SOURCE FOR THIS STEP YETWe have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.
03 TRIED
■ CONFIRMEDNEWEST EVIDENCE · 1 SOURCEAttack attempts on CVE-2024-0204 seen by honeypots (Shadowserver via CIRCL). Attack attempts on CVE-2024-0204 seen by honeypots (Shadowserver via CIRCL).
04 EXPLOITED
□ NO EVIDENCE YETNEWEST EVIDENCE NONE YETNo evidence yet.
SRC: NONE YET05 DAMAGE
□ NOT TRACKED YETNO SOURCE FOR THIS STEP YETBreach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.
When each thing happened
- DISCLOSED
- EXPLOIT CODE PUBLIC
- FIRST ATTACK REPORT
- CISA KEV LISTINGNOT YET
- US FEDERAL DEADLINENOT YET
Questions to ask this week
- Do we run Fortra GoAnywhere MFT? If yes, is it patched or cut off from the internet?
- Who owns fixing it, and by what date?
- Have we checked for signs of attack since the first report, not just since the patch?
How it unfolded
- JAN 21, 2024Metasploit exploit module: Fortra GoAnywhere MFT Unauthenticated Remote Code Execution
- JAN 23, 20243 public GitHub repositories claim a proof of concept for CVE-2024-0204
- MAY 28, 2025Exploit-DB entry: Fortra GoAnywhere MFT 7.4.1 - Authentication Bypass
- Attack activity. OCT 21, 2026Attack attempts on CVE-2024-0204 seen by honeypots (Shadowserver via CIRCL) (2 reports, latest OCT 22)
SOURCES
- [1] nuclei-templates: Nuclei scan template: Fortra GoAnywhere MFT - Authentication Bypass, OCT 24
- [2] CIRCL Vulnerability-Lookup sightings: Attack attempts on CVE-2024-0204 seen by honeypots (Shadowserver via CIRCL), OCT 22
- [3] Exploit-DB: Exploit-DB entry: Fortra GoAnywhere MFT 7.4.1 - Authentication Bypass, MAY 28
- [4] PoC-in-GitHub: 3 public GitHub repositories claim a proof of concept for CVE-2024-0204, JAN 23
- [5] Metasploit module metadata: Metasploit exploit module: Fortra GoAnywhere MFT Unauthenticated Remote Code Execution, JAN 21