Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 41

Export CSV
CVE-2026-14316

Heap buffer overflow in boks_sshd revoked-key error handling

The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf() writes the full message, it can write past the end of the heap allocation.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Core Privileged Access Manager (boks)
CVE-2026-79896

Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normally restarted automatically, repeated requests can sustain the service interruption.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Boks Manager
CVE-2026-12627

Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability

Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Core Privileged Access Manager (boks)
CVE-2026-79901

Predictable Active Directory service-account passwords in BoKS Manager

In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Boks Manager Boks-server
CVE-2026-79900

Heap overflow in KSL checksum initialization

boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field before copying it. An authenticated KSL client can supply an oversized, OpenSSL-recognized digest name and write beyond the end of the heap allocation.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Boks Manager Boks-server
CVE-2026-79899

Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate creation.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Boks Manager
CVE-2026-79898

Fortra BoKS Manager crlserver command injection vulnerability

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec rule; non-root use of cacrl requires such a rule.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Boks Manager
CVE-2026-9864

Fortra BoKS Server Agent adjoin machine-account password generation vulnerability

Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Core Privileged Access Manager (boks)
CVE-2026-15913

Path Traversal in Fortra's GoAnywhere MFT Endpoint

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Mft
CVE-2026-12163

Stored XSS in Fortra File Integrity Monitoring (FIM)

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting (XSS) vulnerability in the Asset View UI component. An authenticated user with sufficient privileges to create or modify affected node or database configuration fields could store script content that may be rendered as HTML instead of safely escaped text when the affected Asset View UI content is displayed.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
File Integrity Monitoring File Integrity Monitoring (fim)
CVE-2026-12164

Privilege Escalation in Fortra File Integrity Monitoring (FIM)

Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission relationships.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
File Integrity Monitoring File Integrity Monitoring (fim)
CVE-2026-9862

Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability

Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Core Privileged Access Manager (boks) Core Privileged Access Manager Server
CVE-2026-9863

Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability

Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Core Privileged Access Manager (boks) Core Privileged Access Manager Server
CVE-2026-0972

HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer Goanywhere Mft
CVE-2025-14362

GoAnywhere MFT SFTP Service Login Vulnerable to Brute Force Attack Under Certain Circumstances

The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to log in with an SSH Key, making the SSH key vulnerable to being guessed via Brute Force.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer Goanywhere Mft
CVE-2025-1241

Encryption vulnerable to brute-force decryption in GoAnywhere MFT

Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Fortra Linux and 1 more
Products
Macos Goanywhere Agents Goanywhere Managed File Transfer and 3 more
CVE-2026-0971

GoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeout

An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer Goanywhere Mft
CVE-2026-1089

User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Goanywhere Managed File Transfer Goanywhere Mft
CVE-2024-5275

Hard-coded password in FileCatalyst Direct 3.8.10 Build 138 TransferAgent (and earlier) and FileCatalyst Workflow 5.1.6 Build 130 (and earlier)

A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be read out, for example, the private key for certificates. Exploit of this vulnerability could lead to a machine-in-the-middle (MiTM) attack against users of the agent. This issue affects all versions of FileCatalyst Direct from 3.8.10 Build 138 and earlier and all versions of FileCatalyst Workflow from 5.1.6 Build 130 and earlier.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Filecatalyst Direct Filecatalyst Workflow
CVE-2024-4332

Improper Authentication in Tripwire Enterprise 9.1.0 APIs

An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs and lead to unauthorized information disclosure or modification.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Fortra
Products
Tripwire Enterprise