How severe is CVE-2024-0204?

CVE-2024-0204 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-0204 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 95% (100th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-0204?

CVE-2024-0204 primarily affects Fortra Goanywhere Managed File Transfer. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-0204?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2024-0204 have an EU (EUVD) identifier?

Yes. CVE-2024-0204 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-16003.

When was CVE-2024-0204 published?

CVE-2024-0204 was published on 2024-01-22 and last updated on 2026-06-17.

CVE-2024-0204

CVE-2024-0204 is a critical-severity vulnerability in Fortra Goanywhere Managed File Transfer with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 95% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-425.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 95% (100th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-16003
Weakness: CWE-425
Affected product: Fortra Goanywhere Managed File Transfer
Published: 2024-01-22
Last modified: 2026-06-17

Description

Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.

Frequently asked questions

What is CVE-2024-0204?: Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
How severe is CVE-2024-0204?: CVE-2024-0204 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-0204 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 95% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-0204?: CVE-2024-0204 primarily affects Fortra Goanywhere Managed File Transfer. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-0204?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2024-0204 have an EU (EUVD) identifier?: Yes. CVE-2024-0204 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-16003.
When was CVE-2024-0204 published?: CVE-2024-0204 was published on 2024-01-22 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*
cpe:2.3:a:fortra:goanywhere_managed_file_transfer:6.0.0:*:*:*:*:*:*:*

More vulnerabilities in Fortra Goanywhere Managed File Transfer

CVE-2025-10035 — Critical (CVSS 10.0): A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged…
CVE-2025-14362 — High (CVSS 7.3): The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User…
CVE-2023-0669 — High (CVSS 7.2): Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the…
CVE-2026-1089 — Medium (CVSS 6.5): User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS…
CVE-2024-25157 — Medium (CVSS 6.5): An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent…
CVE-2024-25156 — Medium (CVSS 6.5): A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent…

All CVEs affecting Fortra Goanywhere Managed File Transfer →

Other CWE-425 vulnerabilities

CVE-2025-26689 — Critical (CVSS 9.8): Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If a remote…
CVE-2022-45276 — Critical (CVSS 9.8): An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the…
CVE-2022-26279 — Critical (CVSS 9.8): EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.
CVE-2021-36560 — Critical (CVSS 9.8): Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads…
CVE-2021-36745 — Critical (CVSS 9.8): A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for…
CVE-2021-24215 — Critical (CVSS 9.8): An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2.…

Browse all CWE-425 vulnerabilities →