CVE-2023-0669

CVE-2023-0669: Fortra GoAnywhere MFT License Response Servlet Command Injection

Vendor Fortra

Product Goanywhere MFT

Weakness CWE-502 · Unsafe deserialization

KEV Status Known Exploited

Ransomware Used in campaigns

Published February 6, 2023

Last update October 21, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

CISA mandated remediation

02CISA Required Action

Apply updates per vendor instructions.

Key dates

03Disclosure timeline

February 6, 2023 CVE published

October 21, 2025 Record updated

External resources

04References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-0669 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html CISA KEV Reference https://www.cisa.gov/news-events/cybersecurity-advisories/aa23… CISA KEV Reference https://my.goanywhere.com/webclient/DownloadProductFiles.xhtml. CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2023-0669

Related vulnerabilities

CVE-2023-0669: Fortra GoAnywhere MFT License Response Servlet Command Injection

01Description

02CISA Required Action

03Disclosure timeline

04References

05Related CVE