Known exploited vulnerabilities
Fortra vulnerabilities attackers have used
Every Fortra vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.
The short answer
CISA lists 4 Fortra vulnerabilities as exploited in the wild, 0 of them added in the last 12 months and 2 used in ransomware campaigns. The most recent is CVE-2025-10035, added Sep 29, 2025. Cobalt Strike has the most entries (2).
- In KEV, all time
- 4
- Added, last 12 months
- 0
- Used in ransomware
- 2
- New CVEs this week
- 0
By product
Cobalt Strike (2), GoAnywhere MFT (2).
Every Fortra entry in CISA KEV
Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
CVE-2022-42948
Added · dueFortra Cobalt Strike User Interface Remote Code Execution Vulnerability
Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.
CVE-2022-39197
Added · dueFortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
Fortra GoAnywhere MFT Remote Code Execution Vulnerability
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
Related
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.