CVE-2026-0972

Summary

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0.

Note: The title, details, and description of this CVE were corrected post-publishing.

Affected Software

Weaknesses

• CWE-74: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Workarounds

Reduce access to the system.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

CVE Program Container

Additional References

• http://seclists.org/fulldisclosure/2026/Apr/8

References

• https://www.fortra.com/security/advisories/product-security/fi-2026-006

• ←Previous
• Next→