GoAnywhere MFT CVE-2026-0972

Upgrade GoAnywhere MFT to version 7.10.0 or later, which enforces login attempt limits on SFTP SSH key authentication attempts per vendor advisory FI-2026-004 (https://fortra.com/security/advisories/product-security/fi-2026-004). If immediate patching is not feasible, implement network-layer rate limiting on TCP port 22 (SFTP) using firewall rules or intrusion prevention systems to block IP addresses exceeding threshold authentication attempts per time window (e.g., 10 attempts per 5 minutes); this requires ongoing monitoring and may impact legitimate users during key rotation. Restrict SFTP service access to trusted IP ranges via firewall ACLs, eliminating internet exposure if remote access is unnecessary; this prevents external brute-force but limits business flexibility for partner file transfers. Audit existing SSH keys for strength: rotate any RSA keys under 3072 bits to 4096-bit RSA or Ed25519, and ensure encrypted private keys use strong passphrases (16+ characters); weak key remediation does not fix the rate-limiting vulnerability but reduces brute-force feasibility. Consider temporarily converting high-privilege Web Users to password authentication with MFA until patching completes, though this reduces operational security benefits of key-based authentication.