CVE-2026-1089

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1089", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "state": "PUBLISHED", "assignerShortName": "Fortra", "dateReserved": "2026-01-16T21:03:16.471Z", "datePublished": "2026-04-21T14:14:58.244Z", "dateUpdated": "2026-04-21T15:00:35.492Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2026-04-21T14:14:58.244Z"}, "title": "User\u2011Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-142", "descriptions": [{"lang": "en", "value": "CAPEC-142 DNS Cache Poisoning"}]}], "affected": [{"vendor": "Fortra", "product": "GoAnywhere MFT", "versions": [{"status": "affected", "version": "0", "lessThan": "7.10.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "User\u2011Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as\u00a0DNS Rebinding and Information Disclosure.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "User\u2011Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure."}]}], "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2026-005"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}}], "solutions": [{"lang": "en", "value": "Upgrade to a remediated version (version 7.10.0 or later).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Upgrade to a remediated version (version 7.10.0 or later)."}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-21T15:00:15.290199Z", "id": "CVE-2026-1089", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T15:00:35.492Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1089", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T15:00:15.290199Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T15:00:31.947Z"}}], "cna": {"title": "User\u2011Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-142", "descriptions": [{"lang": "en", "value": "CAPEC-142 DNS Cache Poisoning"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Fortra", "product": "GoAnywhere MFT", "versions": [{"status": "affected", "version": "0", "lessThan": "7.10.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to a remediated version (version 7.10.0 or later).", "supportingMedia": [{"type": "text/html", "value": "Upgrade to a remediated version (version 7.10.0 or later).", "base64": false}]}], "references": [{"url": "https://www.fortra.com/security/advisories/product-security/fi-2026-005"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "User\u2011Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as\u00a0DNS Rebinding and Information Disclosure.", "supportingMedia": [{"type": "text/html", "value": "User\u2011Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2026-04-21T14:14:58.244Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1089", "state": "PUBLISHED", "dateUpdated": "2026-04-21T15:00:35.492Z", "dateReserved": "2026-01-16T21:03:16.471Z", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "datePublished": "2026-04-21T14:14:58.244Z", "assignerShortName": "Fortra"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "GoAnywhere MFT", "vendor": "Fortra", "versions": [{"lessThan": "7.10.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*", "matchCriteriaId": "8EB6422D-7B12-41B3-BD42-5610C6C72524", "versionEndExcluding": "7.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "User\u2011Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as\u00a0DNS Rebinding and Information Disclosure."}, {"lang": "es", "value": "Encabezado HTTP controlado por el usuario en GoAnywhere MFT de Fortra anterior a la versi\u00f3n 7.10.0 permite a los atacantes activar una consulta DNS, as\u00ed como Rebinding de DNS y revelaci\u00f3n de informaci\u00f3n."}], "id": "CVE-2026-1089", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1089", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-21T15:00:15.290199Z", "version": "2.0.3"}}]}, "published": "2026-04-21T15:16:35.943", "references": [{"source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "tags": ["Vendor Advisory"], "url": "https://www.fortra.com/security/advisories/product-security/fi-2026-005"}], "sourceIdentifier": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.10.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "GoAnywhere MFT", "source": "cna", "vendor": "Fortra"}, "product": "goanywhere_mft", "vendor": "fortra"}], "analysis": {"en": {"generated_at": "2026-04-22T03:06:39.086617+00:00", "value": {"mitigation_remediation": ["Upgrade to GoAnywhere MFT version\u202f7.10.0 or later, which removes the vulnerable header handling logic.", "Restrict or validate incoming HTTP headers so that only trusted values are accepted, preventing the header from being used for arbitrary DNS queries.", "Enable monitoring of DNS request patterns to detect anomalous or unexplained lookups that might indicate exploitation."], "summary": {"action": "Immediate Patch", "impact": "Information Disclosure via DNS Rebinding and Arbitrary DNS lookups"}, "threat_synthesis": {"affected_systems": "Fortra GoAnywhere MFT versions prior to 7.10.0 are impacted. Users should verify their installed version and upgrade to the remediated release.", "description_and_impact": "The vulnerability originates from a user\u2011controlled HTTP header in older releases of Fortra's GoAnywhere MFT. By supplying a specially crafted header, an attacker can cause the server to perform DNS lookups against arbitrary domain names. This can lead to DNS rebinding attacks and leakage of internal host information. The weakness is a form of CWE\u201174, reflecting inadequate validation or encoding of external input. In practice, an adversary could determine internal IP addresses or exploit other components that rely on DNS resolution, leading to information disclosure or facilitating further attacks.", "risk_and_exploitability": "The CVSS score of 6.5 denotes a moderate severity. Exploitation requires the attacker to send HTTP requests with a manipulated header to the MFT server; therefore, it is limited to network\u2011reachable endpoints. As EPSS information is unavailable, the attack probability cannot be quantified, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no public exploitation is known. Nonetheless, because DNS rebinding can expose internal systems, administrators should treat this as a risk that can be mitigated by patching."}}}}, "created": "2026-04-22T03:15:06.409766+00:00", "updated": "2026-04-22T11:46:25.686045+00:00", "vendors": ["fortra", "fortra$PRODUCT$goanywhere_mft"]}