Fortra GoAnywhere MFT CVE-2025-1241

Exploitation requires high-privilege administrative access to GoAnywhere MFT or direct access to encrypted configuration/log files. The attacker must be able to obtain encrypted values from the system (either via administrative credentials, configuration file access, or log extraction). Brute-force attack success depends on the entropy of the encrypted plaintext - weak or short passwords are decrypted quickly; strong or long values may require prohibitive computational effort. The vulnerability is NOT exploitable by unauthenticated remote users or low-privilege users without admin credentials. Exploitation is limited by the attacker's computational capacity and the complexity of the plaintext being decrypted. Organizations using strong password policies and infrequent credential storage in GoAnywhere may see reduced practical impact, though the technical vulnerability remains present.

CVSS 5.8 with vector AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N indicates moderate real-world risk. Network accessibility and confidentiality impact are concerning, but three factors limit practical exploitation: (1) High-privilege requirement (PR:H) restricts attackers to admin users or those with credential theft; (2) High attack complexity (AC:H) reflects the computational effort required for brute-forcing; (3) Confidentiality impact is limited to encrypted values an attacker can observe, not all stored data. The cross-scope impact (S:C) suggests encrypted values may affect other systems or users. No EPSS score, KEV status, or POC availability data provided. Without active exploitation confirmation, this is a targeted risk affecting organizations where admin-to-admin threats or credential compromise are realistic concerns. Organizations with strong privileged access controls and audit logging may assess this as lower priority than the base CVSS suggests. Conversely, organizations with weak IAM or frequent credential rotation should prioritize patching. The lack of integrity impact (I:N) means encrypted data cannot be modified by brute-forcing alone.

A disgruntled system administrator with legitimate access to GoAnywhere MFT exports or observes encrypted credential values from configuration or logs. Using the known static IV and high computational resources (GPU-accelerated brute-forcing), the attacker tests common password candidates and cryptographic keys offline until successfully decrypting sensitive values such as database connection strings, API credentials, or file transfer passwords. These decrypted credentials are then used to access backend systems outside of GoAnywhere's audit logging. Exploitation requires both administrative privileges and time/resources for computation, but leaves no direct evidence in GoAnywhere's transaction logs once decryption is offline.