{"id":"CVE-2023-0669","published":"2023-02-06T20:15:14Z","modified":"2026-08-06T05:16:38Z","title":"Fortra GoAnywhere MFT Remote Code Execution Vulnerability","vendor":"Fortra","product":"GoAnywhere MFT","tier":"core","eol":null,"description":{"text":"Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.","provenance":"source","from":"NVD"},"summary":{"text":"Fortra GoAnywhere MFT contains a command injection flaw in its License Response Servlet, caused by deserialization of an attacker-controlled object. The flaw is in the GoAnywhere MFT product itself, within the License Response Servlet component. An attacker with network access to the affected servlet can execute commands on the system without authenticating, and the attack requires no user interaction, with exploitation needing only that the attacker can reach the servlet and send crafted input.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:01Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99996,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-02-10","dueDate":"2023-03-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://my.goanywhere.com/webclient/DownloadProductFiles.xhtml. Fortra users must have an account in order to login and access the patch.;  https://nvd.nist.gov/vuln/detail/CVE-2023-0669","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-02-08","exploitedFirstSeen":"2023-02-08","ransomware":true,"evidence":[{"url":"https://www.huntress.com/blog/investigating-intrusions-from-intriguing-exploits","date":"2023-02-08"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-02-10"},{"url":"https://www.hhs.gov/sites/default/files/clop-allegedly-targeting-healthcare-industry-sector-alert.pdf","date":"2023-02-22"},{"url":"https://www.rubrik.com/blog/company/23/3/fortra-goanywhere","date":"2023-03-14"},{"url":"https://www.bleepingcomputer.com/news/security/hitachi-energy-confirms-data-breach-after-clop-goanywhere-attacks/","date":"2023-03-17"},{"url":"https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-saks-fifth-avenue-retailer-says-mock-data-stolen/","date":"2023-03-21"},{"url":"https://www.dragos.com/blog/ransomware-attack-analysis-q1-2023/","date":"2023-04-20"},{"url":"https://www.hhs.gov/sites/default/files/cl0p-lockbit-new-data-breaches-sector-alert.pdf","date":"2023-04-28"},{"url":"https://4502402.fs1.hubspotusercontent-na1.net/hubfs/4502402/Ransomware%20-%20Index%20Update%20Q1%202023.pdf","date":"2023-05-15"},{"url":"https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft","date":"2023-06-02"}],"evidenceTotal":792,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis","tags":["Exploit","Third Party Advisory"]},{"url":"https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft","tags":["Broken Link","Third Party Advisory"]},{"url":"https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/17607","tags":["Patch"]},{"url":"https://infosec.exchange/@briankrebs/109795710941843934","tags":["Mitigation","Third Party Advisory"]},{"url":"https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1","tags":["Product"]},{"url":"https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/","tags":["Mitigation","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis","tags":["Exploit","Third Party Advisory"]},{"url":"https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft","tags":["Broken Link","Third Party Advisory"]},{"url":"https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/17607","tags":["Patch"]},{"url":"https://infosec.exchange/@briankrebs/109795710941843934","tags":["Mitigation","Third Party Advisory"]},{"url":"https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1","tags":["Product"]},{"url":"https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/","tags":["Mitigation","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through a cross-site request forgery (CSRF) flaw in GoAnywhere's license installation process. Attackers initiate this vulnerability by leveraging the absence of CSRF protection, allowing them to execute remote code without authentication. This enables them to compromise targeted systems, facilitating ransomware attacks and unauthorized access. This vulnerability has been actively exploited, leading to ransomware attacks by the Clop group. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through a cross-site request forgery (CSRF) flaw in GoAnywhere's license installation process. Attackers initiate this vulnerability by leveraging the absence of CSRF protection, allowing them to execute remote code without authentication. This enables them to compromise targeted systems, facilitating ransomware attacks and unauthorized access. This vulnerability has been actively exploited, leading to ransomware attacks by the Clop group. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited through a cross-site request forgery (CSRF) flaw in GoAnywhere's license installation process. Attackers initiate this vulnerability by leveraging the absence of CSRF protection, allowing them to execute remote code without authentication. This enables them to compromise targeted systems, facilitating ransomware attacks and unauthorized access. This vulnerability has been actively exploited, leading to ransomware attacks by the Clop group. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-0644","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0644","exploited":true,"exploitedSince":"2023-02-10","provenance":"source"},"exploits":[{"id":51339,"url":"https://www.exploit-db.com/exploits/51339","title":"Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)","type":"webapps","platform":"java","date":"2023-04-08","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2023-04-08"},"pocGithub":{"count":4,"skipped":1,"earliest":"2023-02-10","earliestUrl":"https://github.com/0xf4n9x/CVE-2023-0669","repos":[{"name":"0xf4n9x/CVE-2023-0669","url":"https://github.com/0xf4n9x/CVE-2023-0669","stars":102,"created":"2023-02-10"},{"name":"Avento/CVE-2023-0669","url":"https://github.com/Avento/CVE-2023-0669","stars":9,"created":"2023-04-06"},{"name":"yosef0x01/CVE-2023-0669-Analysis","url":"https://github.com/yosef0x01/CVE-2023-0669-Analysis","stars":7,"created":"2023-02-26"},{"name":"cataliniovita/CVE-2023-0669","url":"https://github.com/cataliniovita/CVE-2023-0669","stars":0,"created":"2023-02-15"}]},"metasploit":[{"name":"Fortra GoAnywhere MFT Unsafe Deserialization RCE","module":"exploit/multi/http/fortra_goanywhere_rce_cve_2023_0669","type":"exploit","disclosureDate":"2023-02-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/fortra_goanywhere_rce_cve_2023_0669.rb"}],"nuclei":[{"id":"CVE-2023-0669","name":"Fortra GoAnywhere MFT - Remote Code Execution","severity":"high","path":"http/cves/2023/CVE-2023-0669.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0669.yaml"}],"first":{"date":"2023-02-01","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/fortra_goanywhere_rce_cve_2023_0669.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html","https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis","https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1210"],"provenance":"source"},{"stage":"secondary","techniques":["T1486"],"provenance":"source"}],"timeline":[{"date":"2023-02-01","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-02-10, Exploit-DB 2023-04-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/fortra_goanywhere_rce_cve_2023_0669.rb","provenance":"source"},{"date":"2023-02-06","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0669","provenance":"source"},{"date":"2023-02-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.huntress.com/blog/investigating-intrusions-from-intriguing-exploits","provenance":"source"},{"date":"2023-02-10","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-02-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0644","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":4},"priority":{"score":78.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1360 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 1 Exploit-DB entry; 4 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}