GoAnywhere MFT EUVD-2026-24129

Exploitation requires GoAnywhere MFT SFTP service (TCP port 22) to be network-accessible to the attacker, and the target Web User account must be specifically configured to authenticate using SSH public key authentication rather than password-based authentication. The attack is only viable against SSH keys with insufficient cryptographic strength (RSA keys under 2048 bits, weak passphrases on encrypted private keys, or algorithmically weak key generation) or when attackers possess partial key material from prior compromises. Network access to the SFTP service is required (AV:N), but the vulnerability does NOT affect Web Users configured for password authentication or those accessing GoAnywhere via HTTPS/administrative interfaces. Organizations not using SSH key authentication for Web Users via SFTP are not exposed. The no-privilege-required (PR:N) vector applies because the brute-force occurs during the authentication phase before any privilege level is established, though successful exploitation yields access at the compromised user's assigned privilege level within GoAnywhere.

CVSS 7.3 (High) reflects network-based remote attack (AV:N) with low complexity (AC:L) requiring no privileges (PR:N) or user interaction (UI:N), yielding partial impact across confidentiality, integrity, and availability (C:L/I:L/A:L). Real-world risk depends critically on SSH key deployment practices: organizations using strong 4096-bit RSA or Ed25519 keys face computational impracticality of brute-force, while weak keys (1024-bit RSA, short passphrases on encrypted keys) become viable targets. The attack requires sustained network connectivity to the SFTP service and significant computational resources, making it lower priority than RCE or authentication bypass vulnerabilities but concerning for internet-exposed GoAnywhere instances with SSH key authentication enabled. Absence of EPSS score and KEV status suggests no observed widespread exploitation at time of vendor disclosure. The PR:N vector contradicts typical SSH key usage (where keys replace passwords as authentication factors) - the vulnerability essentially downgrades SSH key authentication security to brute-forceable without account lockout protection. Priority increases if SFTP service is internet-facing and SSH key users have elevated privileges within GoAnywhere workflows.

An external attacker identifies a GoAnywhere MFT instance with SFTP exposed on the internet and enumerates valid Web User accounts through prior reconnaissance or default naming conventions. The attacker launches an automated SSH key brute-force attack using tools like ssh-keyscan and custom scripts to present thousands of candidate private keys per hour against a target account configured for SSH key authentication. Because the SFTP service lacks rate limiting (CWE-307), the attack continues unthrottled until a matching key is discovered or weak keys are compromised, granting the attacker authenticated SFTP access to upload malicious files, exfiltrate sensitive data transfers, or pivot into GoAnywhere workflows with the compromised user's permissions.