CVE-2023-0669

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 1.000 · 100 %ileexploit · weaponizedEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 7 exploits · weaponized

Likely / severe?

100.0% (100th) EPSS

CVSS 7.2 · high

Is it mine?

4 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

added 2023-02-10remediate by 2023-03-03

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-26

Fortra GoAnywhere MFT Remote Code Execution Vulnerability

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

cvss

Technical severity, 0–10. One row per scoring source.

7.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.3–7.2

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.2 · impact 5.9

v3.16.3mediumAV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 1.2 · impact 5.9

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USprimaryCWE-502USCWE-502US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (7)

Public proof-of-concept and weaponised exploit code.

exploit/multi/http/fortra_goanywhere_rce_cve_2023_0669Fortra GoAnywhere MFT Unsafe Deserialization RCEweaponized · metasploit
EDB-51339Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)PoC · exploit_db
0xf4n9x/CVE-2023-0669CVE-2023-0669 GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.PoC · poc_in_github
Avento/CVE-2023-0669GoAnywhere MFT CVE-2023-0669 LicenseResponseServlet Deserialization Vulnerabilities Python RCE PoC(Proof of Concept)PoC · poc_in_github
cataliniovita/CVE-2023-0669CVE-2023-0669 GoAnywhere MFT command injection vulnerabilityPoC · poc_in_github
yosef0x01/CVE-2023-0669-AnalysisCVE analysis for CVE-2023-0669PoC · poc_in_github

affected products (4)

Products and version ranges known to be affected.

Fortra GoAnywhere MFT≤ 0 ≤7.1.1enisa_euvdEU
Fortra, LLC GoAnywhere MFT≤ 7.1.2fstec_bduRU
fortra goanywhere managed file transfer< 7.1.2nvdUScpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*
RubyGems metasploit-framework≤ 6.0.33osvUSpkg:gem/metasploit-framework

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-6pm2-j2v8-h3cjWithdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework2023-02-06ghsa · osvUS
## Withdrawn This advisory has been withdrawn because it was incorrectly associated with the metasploit-framework package, which is not affected by this CVE, and the actual vulnerable component does not fit within our supported ecosystems. This link is maintained to preserve external references. ## Original Description Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

published 2023-02-06modified 2026-08-24

related (3,742)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-63077US	—OT critical	93.6% (100th)	KEV	2026-07-27
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2026-58644US	—OT critical	15.9% (97th)	KEV	2026-07-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-50522US	—OT critical	3.04% (87th)	KEV	2026-07-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-12569US	critical9.8OT critical	46.0% (99th)	KEV	2026-06-18
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of u…
CVE-2026-45247US	—OT critical	26.2% (98th)	KEV	2026-05-26
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code exec…

+3737 more

references (30)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan