CVE-2026-0972 — HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT

CVE-2026-0972

HTML Injection possible in system generated emails in Fortra's GoAnywhere MFT PUBLISHED

Description (CNA)

HTML injection is possible in system generated emails in Fortra's GoAnywhere MFT prior to 7.10.0. Note: The title, details, and description of this CVE were corrected post-publishing.

Affected (CNA)

Vendor / product	Versions
Fortra / GoAnywhere MFT	affected 0 before 7.10.0

CWE

CWE-74

References

https://www.fortra.com/security/advisories/product-security/fi-2026-006

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2026/Apr/8