VULNERABILITY INTELLIGENCE

CVE-2025-8148

CVSS score4.2 MEDIUM
EPSS probability0.17%
CISA KEVNot currently listed
Published2025-12-05
Last modified2026-09-25
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.

Weakness classification

  • CWE-732: Incorrect Permission Assignment for Critical Resource
  • CWE-863: Incorrect Authorization

Primary references