CVE-2023-0669: Fortra GoAnywhere MFT deserialization RCE — the Clop mass-exploitation flaw
The short version: Fortra's GoAnywhere MFT has a deserialization flaw in its License Response Servlet (CVE-2023-0669) that leads to remote code execution. NVD scores it 7.2 — but in the real world the Clop/Cl0p ransomware group used it as a zero-day to breach and extort scores of organizations. It's in CISA's KEV catalog. The base score understates it; the exploitation history does not. Steady hands — patch and hunt.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 7.2 — High · AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.99% · ~100th percentile (2026-07-17) |
| In CISA KEV? | Yes — added 2023-02-10; remediation was due 2023-03-03 |
| Known exploited? | Yes — mass-exploited as a zero-day by the Clop/Cl0p ransomware group; data theft claimed from ~130 organizations |
| Vulnerability type | CWE-502 deserialization of untrusted data → remote code execution |
| Requires authenticated session? | NVD scored it PR:H, but it was exploited in practice against exposed admin consoles as a pre-authentication issue |
| Affected | GoAnywhere MFT prior to 7.1.2 |
| Fixed in | GoAnywhere MFT 7.1.2 and later |
What you need to know
CVE-2023-0669 is a deserialization flaw in the GoAnywhere License Response Servlet. An attacker who can reach that endpoint feeds it an attacker-controlled serialized object, which is deserialized unsafely and turned into remote code execution on the server.
This is the flaw that put GoAnywhere on the map as an extortion target:
- How they found it — the admin console (and its servlet) was reachable on the internet in many deployments.
- How they used it — Clop exploited it as a zero-day in February 2023, executing code and stealing data at scale.
- What it led to — one of the year's signature data-theft-extortion campaigns, with the group claiming exfiltration from roughly 130 organizations.
There's a scoring quirk worth understanding: NVD assigned PR:H (privileges required), which drags the base score down to 7.2. In the field, the servlet was reachable on exposed consoles and the flaw behaved as a pre-authentication RCE — which is why its practical severity ran far past the number.
How serious we see it
High — in practice, not on paper.
The 7.2 is a defensible NVD calculation and a misleading measure of real risk. Remote code execution on an internet-facing file-transfer platform, mass-exploited by a ransomware group for large-scale data theft, is as serious as it gets — and we rate it by what it did, not by which privileges metric NVD selected. The bounded, reassuring part: a single fixed version (7.1.2) closes it, and exposure is quick to determine. The catch, for anyone who somehow ran it exposed and unpatched, is that this was an active data-theft campaign — patched and clean are separate questions.
Recommendations
Straight from Fortra's advisory and CISA:
- Patch now. Upgrade to GoAnywhere MFT 7.1.2 or later — well past due, given the 2023 timeline.
- Get the admin console off the public internet. Restrict administrative access to trusted networks; this was Fortra's immediate guidance.
- Hunt for prior compromise. Review the server for webshells, unexpected accounts, and signs of data staging or exfiltration.
- If you find indicators, respond fully. Rebuild, rotate all credentials and keys, and assess what data the server held.
- Confirm your exposure first. Verify whether any GoAnywhere MFT admin console is internet-facing and on an affected build.
How BreachRisk sees it
BreachRisk discovers internet-facing GoAnywhere MFT portals from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed, actively exploited flaws like this one — surfaced at the top of your results because it's in KEV and because our severity take reflects the real-world impact, not just the 7.2. This one is detected by fingerprinting the exposed, affected version and flagging it; we identify and prioritize the exposure rather than exploiting it.
The value of a continuous, attacker's-eye view is precisely for flaws like this, where the CVSS band undersells the danger: the exposed platform is ranked by how it actually gets used against you, not by a number that stops at "privileges required."