CVE-2024-0204 is a critical (CVSS 9.8) authentication bypass in Fortra GoAnywhere MFT before 7.4.1. An unauthorized user can create an admin user through the administration portal. Fortra lists 7.4.1 as the fixed release, so upgrade and check the vendor advisory for any extra steps.
What's affected
The NVD record says GoAnywhere MFT versions prior to 7.4.1 are affected. Version 7.4.1 is the fixed release named in the record.
Fortra's advisory is FI-2024-001, and the record also links to the GoAnywhere security advisories page. We could not load the Fortra advisory when preparing this post because the site returned an access error, so we cannot restate its workaround steps. Read the advisory directly for mitigations, and use it to confirm which versions and deployment types it covers.
How to check if you're exposed
Find the installed version in the GoAnywhere administration portal or from the installation directory, and compare with 7.4.1. Also check how the administration portal is reachable. If it faces the internet, treat the instance as higher priority.
Review the list of admin users in the portal for accounts nobody on your team created, and check the audit logs for admin creation events. Managed file transfer systems hold files from many partners, so unexpected admin accounts matter.
What to do now
- Confirm your GoAnywhere MFT version and move to 7.4.1 or later.
- Open Fortra advisory FI-2024-001 and apply any mitigation it lists if you cannot upgrade at once.
- Take the administration portal off the public internet and limit it to trusted networks or a VPN.
- Audit admin accounts and recent account creation, and remove any you cannot explain.
- If you find unknown admins, treat the system as compromised: rotate credentials and keys, and review transferred files.
Why it matters
The record lists CWE-425, direct request or forced browsing. A page or function that should be protected can be reached directly, without passing the checks that normally come first. Here the result is the creation of an administrator account by someone who has not authenticated.
The CVSS vector is network, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability, which gives 9.8. The record's KEV field is false, and we could not read the Fortra advisory, so we make no claim either way about exploitation. The record does list public write ups among its references, so assume the technical details are known. Check CISA KEV and the Fortra advisory for current status. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Quick check
Is it exploited in the wild?
The record shows KEV as false and we could not read the vendor advisory. The record links public technical write ups, so patch quickly and check the Fortra advisory for the current status.
What is the fixed version?
The NVD record lists GoAnywhere MFT 7.4.1 as the first version not affected.
Sources
Last reviewed: 19 October 2026.
