CVE-2026-0972

Description

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing.

References

https://www.fortra.com/security/advisories/product-security/fi-2026-006

http://seclists.org/fulldisclosure/2026/Apr/8

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS