CVE-2026-0971

{
  "id": "CVE-2026-0971",
  "sourceIdentifier": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
  "published": "2026-04-21T15:16:35.717",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected to the regular login page instead of the SAML login page."
    },
    {
      "lang": "es",
      "value": "Un problema de tiempo de espera de sesión inadecuado en GoAnywhere MFT de Fortra, anterior a la versión 7.10.0, provoca que los Usuarios Web configurados con SAML sean redirigidos a la página de inicio de sesión regular en lugar de la página de inicio de sesión de SAML."
    }
  ],
  "affected": [
    {
      "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
      "affectedData": [
        {
          "vendor": "Fortra",
          "product": "GoAnywhere MFT",
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "7.10.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-21T19:26:48.832583Z",
          "id": "CVE-2026-0971",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "7.10.0",
              "matchCriteriaId": "8EB6422D-7B12-41B3-BD42-5610C6C72524"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://fortra.com/security/advisories/product-security/fi-2025-013",
      "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
      "tags": [
        "Not Applicable"
      ]
    }
  ]
}