CVE-2026-1089

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - df4dee71-de3a-4139-9588-11b62fe6c0ff

Published

2026-04-21

Last modified

2026-10-26

Weaknesses

CWE-74

Affected products

• Goanywhere Managed File Transfer (Fortra)
• Goanywhere Mft (Fortra)

References

• https://www.fortra.com/security/advisories/product-security/fi-2026-005