CVE-2025-8148: An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH…

PriorityP424medium4.2CVSS 3.1

AVNACHPRLUINSUCLILAN

EPSS

0.15%

4.5th percentile

An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
fortra	goanywhere_managed_file_transfer	< 7.9.0	7.9.0
fortra	goanywhere_mft	< 7.9.0	7.9.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.