[ Vendor · 12 CVEs ]
Fortra
CVEs affecting Fortra published in the last 30 days, plus any Fortra CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-14316 | 1 Oct 2026 | CVSS 8.1 | Fortra Core Privileged Access Manager (BoKS)The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final… | |
| CVE-2026-9864 | 1 Oct 2026 | CVSS 4.8 | Fortra Core Privileged Access Manager (BoKS)Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during… | |
| CVE-2026-79896 | 1 Oct 2026 | CVSS 7.5 | Fortra BoKS ManagerFortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated… | |
| CVE-2026-12627 | 1 Oct 2026 | CVSS 9.8 | Fortra's Core Privileged Access Manager (BoKS)Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with… | |
| CVE-2026-79898 | 1 Oct 2026 | CVSS 9.1 | Fortra BoKS ManagerFortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI… | |
| CVE-2026-79899 | 1 Oct 2026 | CVSS 7.9 | Fortra BoKS ManagerFortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without… | |
| CVE-2026-79900 | 1 Oct 2026 | CVSS 6.5 | Fortra BoKS Manager boks-serverboks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL… | |
| CVE-2026-79901 | 1 Oct 2026 | CVSS 9.9 | Fortra BoKS Manager boks-serverIn deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a… | |
| CVE-2025-10035 | 18 Sep 2025 | CVSS 9.8 | Fortra GoAnywhere MFT Deserialization of Untrusted DataA deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to… | Exploited |
| CVE-2022-42948 | 24 Mar 2023 | CVSS 9.8 | Fortra Cobalt Strike User Interface Remote Code ExecutionCobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to… | Exploited |
| CVE-2023-0669 | 6 Feb 2023 | CVSS 7.2 | Fortra GoAnywhere MFT Remote Code ExecutionFortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due… | ExploitedFix |
| CVE-2022-39197 | 22 Sep 2022 | CVSS 6.1 | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS)An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the… | Exploited |