Skip to content
Exploit Radar Choose my productsProducts My radar
English

Products › Brands

Brand

Fortra: actively exploited vulnerabilities

4 vulnerabilities in Fortra products (Cobalt Strike, GoAnywhere MFT) are in CISA’s catalog of exploited vulnerabilities. Last added: September 29, 2025.

Fortra security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one Fortra category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • Cobalt Strike 2 vulnerabilities · Security products
  • GoAnywhere MFT 2 vulnerabilities · File transfer (MFT)

Name used by CISA: Fortra. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Fortra list.

  1. Rank 1Fortra GoAnywhere MFT

    CVE-2025-10035

    Ransomware

    Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

    Added in the last 12 months: ranked by severity.

    Added
    Sep 29, 2025
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  2. Rank 2Fortra Cobalt Strike

    CVE-2022-42948

    Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 30, 2023
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  3. Rank 3Fortra GoAnywhere MFT

    CVE-2023-0669

    Ransomware

    Fortra GoAnywhere MFT Remote Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Feb 10, 2023
    CISA deadline
    21 days
    CVSS severity
    7.2 (high)

  4. Rank 4Fortra Cobalt Strike

    CVE-2022-39197

    Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 30, 2023
    CISA deadline
    21 days
    CVSS severity
    6.1 (medium)

Follow and verify

Indicative classification, based on the vendor and product names given by CISA. How products are classified.