CVE-2023-0669 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-0669HIGH

Fortra GoAnywhere MFT License Response Servlet Command Injection

  AV  AC  PR  UI  S  C  I  A   CVSS     EPSS    %ile   KEV
   N   L   H   N  U  H  H  H    7.2   1.0000   100.0   YES

AFFECTED
  Product         Versions     Fixed
  Goanywhere MFT  unspecified  —

TIMELINE
  Feb 3   Reserved by rapid7
  Feb 10  Added to CISA KEV, remediation due 2023-03-03
  Feb 10  Published (CNA: rapid7)
  Aug 5   EXPLOIT PUBLISHED — CVE-2023-0669 (Fortra Goanywhere MFT). Public exploit reference added.

CWE-502 · CNA: rapid7 · CVSS v3.1 · 9 references · NVD status: Analyzed · KEV due March 3, 2023

Description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
February 3, 2023	Reserved	Reserved by rapid7
February 10, 2023	KEV ADDED	Added to CISA KEV, remediation due 2023-03-03
February 10, 2023	Published	Published (CNA: rapid7)
August 5, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2023-0669 (Fortra Goanywhere MFT). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Fortra	Goanywhere MFT	—	—	—

Weaknesses

CWE-502

References (9)

http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html [Exploit, Third Party Advisory, VDB Entry]
https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis [Exploit, Third Party Advisory]
https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft [Broken Link, Third Party Advisory]
https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html [Exploit, Third Party Advisory]
https://github.com/rapid7/metasploit-framework/pull/17607 [Patch]
https://infosec.exchange/@briankrebs/109795710941843934 [Mitigation, Third Party Advisory]
https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1 [Product]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669 [US Government Resource]
https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/ [Mitigation, Third Party Advisory]

Authoritative record: CVE-2023-0669 at cve.org

Vendors: fortra

Weaknesses: CWE-502

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-0669 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.