Loading story…
A critical authentication bypass vulnerability in Fortra GoAnywhere MFT allows unauthenticated attackers to create a new administrative user by directly accessing the /InitialAccountSetup.xhtml endpoint. Tracked as CVE-2024-0204, the flaw stems from improper path normalization and affects versions earlier than 7.4.1. Public reporting said most observed internet-exposed instances were still running vulnerable releases, raising the risk of opportunistic compromise.
Fortra and defenders urged organizations to upgrade immediately to GoAnywhere MFT 7.4.1 or later. As a temporary mitigation for non-containerized deployments, administrators were advised to remove the vulnerable setup page and restart services:
rm -f $GOANYWHERE_INSTALL_DIR/adminroot/WEB-INF/classes/com/linoma/ga/ui/admin/InitialAccountSetup.xhtml
The issue was identified by Mohammed Eldeeb and Islam Elrfai of Spark Engineering Consultants, and technical analysis showed the bug could be abused to regain access to an initialization workflow that should no longer be reachable after first-time setup.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A critical authentication bypass vulnerability, CVE-2024-0204, was identified in Fortra GoAnywhere MFT by Mohammed Eldeeb and Islam Elrfai of Spark Engineering Consultants. The flaw affects versions earlier than 7.4.1 and can let an unauthenticated attacker create a new administrative user via the /InitialAccountSetup.xhtml endpoint.
On 2024-02-05, CSIRT.SK published a notice about CVE-2024-0204, stating that 96.4% of observed GoAnywhere instances were running a vulnerable version. The advisory recommended upgrading to GoAnywhere MFT 7.4.1 or later, or temporarily removing InitialAccountSetup.xhtml and restarting services in non-containerized deployments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortra released security updates for **GoAnywhere MFT** to fix **`CVE-2025-10035`**, a critical deserialization flaw in the product's **License Servlet** that can let a remote, unauthenticated attacker inject commands and take full control of vulnerable systems. The issue carries a **CVSS v3.1 score of 10.0** and affects **7.8.x before 7.8.4** and **7.6.x before Sustain Release 7.6.3**, with internet-exposed administrative consoles facing the highest risk. CSIRT.SK reported the vulnerability is **actively exploited** and may have been abused since at least **2025-09-10**. Defenders were urged to upgrade immediately, restrict administrative access through firewall rules or VPNs, and review Admin Audit and application logs for indicators of compromise, including errors containing **`SignedObject.getObject`**.
Jul 24, 2026Fortra has disclosed CVE-2025-10035, a critical deserialization vulnerability in GoAnywhere MFT's License Servlet, allowing remote attackers to achieve command injection with a forged license response signature. The flaw is rated CVSS 10.0 and is exploitable if the admin console is exposed to the internet. No active exploitation has been confirmed, but the product's history and exposure make immediate patching and mitigation essential.
Jun 29, 2026
A critical authentication bypass vulnerability in Fortinet FortiWeb web application firewalls has been actively exploited in the wild, allowing unauthenticated attackers to create new administrator accounts and fully compromise affected devices. The flaw, which was silently patched in version 8.0.2, enables attackers to send crafted HTTP POST requests to a specific endpoint (`/api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi`) to add privileged users. Security researchers from watchTowr, Defused, and Rapid7 have confirmed exploitation attempts since early October, with proof-of-concept exploits and detection tools now publicly available. The vulnerability has not yet been assigned a CVE, and Fortinet has not released an official advisory or comment as of the latest reports. Organizations running FortiWeb versions prior to 8.0.2 are urged to update immediately or restrict public access to the management interface. Security teams should check for unauthorized admin accounts and investigate for potential compromise if their systems have been exposed since early October. The identity of the threat actors remains unknown, but the attacks are widespread and indiscriminate, targeting internet-facing FortiWeb devices. Researchers have published indicators of compromise and recommended urgent mitigation steps to prevent further exploitation.
Jun 29, 2026