CVE-2025-3871: 
GoAnywhere MFT vulnerability analysis and mitigation

CVE-2025-3871 is a broken access control vulnerability in Fortra's GoAnywhere Managed File Transfer (MFT) that enables unauthenticated attackers to disable legitimate user accounts, creating a denial of service condition. It affects GoAnywhere MFT versions prior to 7.8.1 and is specifically triggered when the product is configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and a targeted user has not set an email address. The vulnerability was published on July 16, 2025, and assigned a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE, ENISA EUVD).

The root cause is classified as CWE-862 (Missing Authorization), where the application fails to properly verify that the entity submitting an email address during the GOTP 2FA flow is authorized to do so (Red Hat CVE, ENISA EUVD). An unauthenticated attacker can exploit this by entering the email address of a known GoAnywhere user when prompted during the 2FA email entry step; if that user has GOTP configured, the system will disable the targeted account. The attack vector is network-based, requires no privileges or user interaction, and the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. No public proof-of-concept code has been identified at this time.

Successful exploitation allows an unauthenticated remote attacker to disable legitimate GoAnywhere MFT user accounts, resulting in a denial of service for those users and potentially disrupting managed file transfer operations. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise from this vulnerability alone. Organizations relying on GoAnywhere MFT for critical file transfer workflows could experience operational disruption if administrative or service accounts are targeted (ENISA EUVD, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-3871 as of the available data. The EPSS score is approximately 0.058%, indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It has been detected by Tenable Nessus (plugin ID 265946), indicating scanner coverage is available (Tenable).

1. Reconnaissance: Identify internet-facing GoAnywhere MFT instances running versions prior to 7.8.1 using tools like Shodan or Censys, or by probing the login portal for version indicators.
2. Identify target users: Enumerate or guess valid GoAnywhere usernames through publicly available information, error message differences, or prior intelligence.
3. Trigger GOTP 2FA flow: Initiate the login process for a known user account to reach the GOTP email 2FA prompt, which appears when the user has GOTP configured but has not set an email address.
4. Submit victim's email address: When prompted for an email address during the 2FA step, enter the email address of the known target user rather than leaving it blank or entering an attacker-controlled address.
5. Account disabled: The application, lacking proper authorization checks, processes the submitted email and disables the targeted user account, achieving a denial of service for that user (ENISA EUVD, Red Hat CVE).

• Logs: GoAnywhere MFT audit logs showing repeated login attempts for specific user accounts followed by account-disabled events, particularly from unexpected or external IP addresses.
• Logs: Authentication logs indicating the GOTP 2FA email prompt being triggered for accounts that do not have an email address configured, especially in rapid succession.
• Network: Unusual or repeated unauthenticated HTTP/HTTPS requests to the GoAnywhere MFT login and 2FA endpoints from a single or small set of external IP addresses.
• Application Events: GoAnywhere MFT administrative alerts or notifications indicating user accounts have been unexpectedly disabled without corresponding administrator action.

Fortra has released GoAnywhere MFT version 7.8.1, which addresses this vulnerability; organizations should upgrade immediately (Fortra Advisory). As a configuration-based workaround prior to patching, administrators should ensure all GoAnywhere user accounts that have GOTP email 2FA configured also have a valid email address set, which removes the precondition for exploitation. Additionally, restricting access to the GoAnywhere MFT login portal to trusted networks or VPN can reduce exposure to unauthenticated attackers.

The vulnerability was noted by security community members on Mastodon (infosec.exchange) shortly after disclosure on July 16, 2025, and was picked up by aggregators including Red Packet Security and cybersecurity-help.cz (Red Packet Security). Red Hat also tracked the advisory, reflecting broader vendor ecosystem awareness. No significant vendor statements beyond Fortra's own advisory or notable researcher deep-dives have been identified at this time.