Fortra GoAnywhere MFT CVE-2026-1089

The vulnerability requires the GoAnywhere MFT application to be accessible over HTTP or HTTPS from the attacker's network (typically the Internet). Exploitation does not require authentication (CVSS PR:N confirmed). The attack succeeds only if the application processes HTTP headers and uses their values in downstream DNS resolution or URL construction without validation. No non-default configuration is needed; the vulnerability exists in standard deployments. The main limiting condition is that the attacker must be able to send HTTP requests to the MFT service and receive or infer responses (e.g., via timing delays, HTTP error messages, or out-of-band callbacks). Exploitation is blocked only by network segmentation that prevents the MFT server from reaching arbitrary external DNS servers or by HTTP header filtering at a perimeter WAF.

This vulnerability presents moderate real-world risk despite a CVSS score of 6.5. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) confirms network-accessible, unauthenticated, low-complexity exploitation with partial confidentiality and availability impact. SSVC assessment confirms automation is feasible and exploitation status is reported as 'none' (suggesting no active public exploitation at CVE publication), but the vulnerability is weaponizable. The key limiting factor is that information disclosure and availability impact are partial - not full system compromise. However, DNS rebinding is a well-understood attack class, and the combination of automatable exploitation + network access + no authentication makes this a strong candidate for exploitation once patched versions are not widely deployed. Organizations running older MFT appliances in DMZ or Internet-facing roles face higher risk. The availability impact (A:L) suggests potential DoS via DNS amplification or backend service overload rather than critical downtime, reducing urgency slightly compared to critical CVSS 9+ findings. Organizations should prioritize patch deployment in production environments, but this is not an emergency requiring immediate shutdown.

An attacker sends a crafted HTTP request to a publicly accessible GoAnywhere MFT instance with a malicious Host or Referer header containing a domain name they control. The application processes this header and triggers a DNS lookup of the attacker's domain. The attacker then updates their DNS record to point to an internal IP address (e.g., 192.168.1.1), causing the MFT server to resolve the attacker's domain to that internal address on the next request. This enables the attacker to probe internal services, exfiltrate metadata via response timing/size, or execute SSRF attacks against backend databases or admin panels. No authentication is required, and the attack can be fully automated and scripted.