Fortra GoAnywhere MFT EUVD-2026-24128

Exploitation requires SAML single sign-on to be explicitly configured in GoAnywhere MFT for the target user account or user group. Users not using SAML authentication (those relying on local or directory-based authentication) are not affected by this vulnerability. A session timeout event must occur - either through natural expiration or by triggering the timeout logic via a crafted request. The attacker must trick the user into clicking a link or performing an action that causes the session to timeout, as passive observation or automated exploitation is not possible without user interaction. Default configurations that do not enable SAML authentication are not vulnerable.

CVSS 4.3 (network-based, low complexity, no privileges required, user interaction needed, low confidentiality impact, no integrity or availability impact) indicates this is a low-to-moderate severity issue. The EPSS score is not provided, limiting confidence in real-world exploitation likelihood. The presence of user interaction (UI:R) is a significant limiting factor - an attacker cannot directly exploit this without tricking a user into clicking a link or manually triggering a session timeout. However, the CVSS vector (AV:N/AC:L/PR:N) indicates the attack is network-accessible and not complex to execute once user interaction occurs. The information disclosure impact (C:L) suggests credential exposure risk if users unknowingly enter credentials into a login page expecting SAML redirection. KEV status is not indicated, and no public exploit code is referenced, suggesting this is not yet actively exploited in the wild. For organizations with SAML-configured GoAnywhere MFT deployments, the risk depends on user awareness and endpoint security controls; for those without SAML configuration, this vulnerability is non-applicable.

A network attacker crafts a malicious link or sends a phishing email containing a URL that triggers a session timeout event on a GoAnywhere MFT instance. When a SAML-configured user clicks the link, the application incorrectly redirects to the regular login page instead of the SAML identity provider. The user, believing this is the legitimate login interface, enters their credentials into the attacker-controlled or monitored page, exposing their authentication data. The attacker captures the credentials for lateral movement or credential reuse attacks.