CVE-2024-0204: Fortra GoAnywhere MFT authentication bypass, create-admin flaw
The short version: Fortra's GoAnywhere MFT — a managed file-transfer product — has an authentication-bypass flaw (CVE-2024-0204) that lets an unauthenticated attacker reach the admin-account setup wizard and create a new administrator through the portal. It scores 9.8 and public exploits have circulated since January 2024. It isn't in CISA's KEV catalog and wasn't mass-exploited, but with a trivial path to admin it's a patch-now item. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — trivial path to admin, public exploits, though not KEV-listed (see below) |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~95% · 99.85th percentile (2026-07-17) |
| In CISA KEV? | No — not listed at time of writing |
| Known exploited? | Not confirmed as mass-exploited; public PoCs since January 2024 and ongoing exploitation attempts reported through 2025 |
| Vulnerability type | CWE-425 forced browsing / direct request → authentication bypass → admin-account creation |
| Requires authenticated session? | No — pre-authentication |
| Affected | GoAnywhere MFT 6.x (from 6.0.1) and 7.x prior to 7.4.1 |
| Fixed in | GoAnywhere MFT 7.4.1 and later |
What you need to know
CVE-2024-0204 is a forced-browsing flaw: the initial-account-setup page, which should only be reachable during first-run configuration, can be reached without authentication via a path-traversal-style request. From there an attacker completes the wizard and creates their own administrator account on the GoAnywhere admin console.
- How they find it — internet-wide scanning surfaces exposed GoAnywhere MFT admin portals.
- How they use it — reach the setup wizard directly and create an admin; a public proof-of-concept (Horizon3.ai) made this point-and-click.
- What it leads to — full administrative control of a file-transfer platform that typically holds sensitive data in motion — a high-value target for extortion, as GoAnywhere's history shows.
How serious we see it
High — an unauthenticated, one-request path to admin, held just short of our top tier because it isn't KEV-listed.
The mechanics are as clean as a bypass gets: reach a page you shouldn't and make yourself an admin. We rate it High rather than Critical because, unlike its GoAnywhere siblings CVE-2023-0669 and CVE-2025-10035, this one wasn't turned into a mass-exploitation campaign and isn't on CISA's KEV list — but public exploits exist and scanning for it has continued, so it's not a gap to leave open, especially on a platform this attractive to extortion crews. The reassuring, bounded part: a single fixed version (7.4.1) closes it, and exposure is quick to determine.
Recommendations
Straight from Fortra's advisory (FI-2024-001):
- Patch now. Upgrade to GoAnywhere MFT 7.4.1 or later.
- Audit administrator accounts. Look for admin accounts you didn't create — the direct signal that this was used against you.
- Get the admin console off the public internet. Restrict administrative access to trusted networks; the admin portal rarely needs to be internet-facing.
- If you find a rogue admin, respond fully. Remove it, rotate credentials and keys, and review what the account could reach.
- Confirm your exposure first. Verify whether any GoAnywhere MFT admin portal is internet-facing and on an affected build.
How BreachRisk sees it
BreachRisk discovers internet-facing GoAnywhere MFT portals from little more than your domain, fingerprints the version, and flags exposure against known-affected builds. Where authorized, it goes beyond detection and safely performs a bounded, non-disruptive check — reaching the setup endpoint to confirm it's accessible, as a benign verification rather than actually creating an account.
That's the difference between "you appear to run a vulnerable GoAnywhere" and "here's a confirmed exposure." For a serious flaw without a KEV deadline forcing the issue, having it mapped and ranked is what keeps it from sitting unpatched on a system that handles your sensitive files.