GoAnywhere MFT CVE-2025-14362

Requires GoAnywhere MFT SFTP service (typically TCP port 22) to be network-accessible to the attacker. Exploitation specifically targets Web User accounts configured with SSH key authentication - accounts using password-only authentication are not affected by this vulnerability. The missing rate limiting only manifests when attackers attempt SSH key-based login, meaning organizations not using SSH keys for Web Users face no risk. Successful compromise requires the targeted SSH key to be weak enough for brute force (short key length, predictable generation, or previously leaked) - properly generated modern SSH keys (2048-bit RSA or Ed25519) remain computationally infeasible to brute force even without rate limiting. Attack feasibility increases if attackers possess leaked key databases or if the environment uses legacy key generation practices.

CVSS 7.3 (High) reflects the network attack vector with no authentication required and low complexity, though impacts are rated Low across confidentiality, integrity, and availability. Real-world risk depends heavily on deployment specifics: organizations using SSH key authentication for SFTP Web Users are vulnerable, while those using password-only authentication or not exposing SFTP externally face no risk. The PR:N (no privileges required) and AC:L (low complexity) vector indicates trivial exploitation once an attacker identifies SSH key-enabled accounts. However, successful brute force against properly generated SSH keys (2048-bit RSA or stronger) is computationally infeasible even without rate limiting, meaning practical risk concentrates on environments with weak/short keys, reused keys, or keys generated by legacy tools. No CISA KEV listing and vendor self-disclosure suggest this has not been actively exploited, likely because most SSH keys are sufficiently strong to resist brute force despite the missing control. SSVC assessment: exploitation state is none, automatable is yes, technical impact is partial (Low CIA), suggesting lower prioritization than initial CVSS suggests unless your environment uses non-standard weak keys or has compliance requirements for authentication rate limiting.

An attacker scans for internet-exposed GoAnywhere MFT SFTP services (typically port 22) and identifies instances running versions below 7.10.0. Using SFTP enumeration techniques, they identify Web User accounts configured for SSH key authentication. The attacker launches an automated brute force attack against these accounts, attempting authentication with thousands of common or leaked SSH private keys and weak key variants without triggering account lockout or rate limiting. If any targeted account uses a weak, leaked, or improperly secured SSH key, the attacker gains authenticated SFTP access with that user's permissions, enabling unauthorized file uploads, downloads, or modifications depending on the account's role within GoAnywhere workflows.