The vulnerability arises from the use of a static initialization vector (IV) in encrypted values handled by GoAnywhere MFT and its agents. Because the IV never changes, an attacker with administrative privileges can perform brute‑force trials to decrypt protected data. This weakness falls under CWE‑326 and results in the potential exposure of confidential information stored or transmitted by the system. The impact is limited to data confidentiality, while integrity and availability are not directly affected.

Fortra’s GoAnywhere MFT versions earlier than 7.10.0 and GoAnywhere Agents earlier than 2.2.0 are affected. These products are used for secure file transfers and management, and the vulnerable encryption mechanism is employed in configuration and data storage components.

The CVSS score of 5.8 reflects a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited prior exploitation. The likely attack vector requires privileged admin access, typically through the Admin Client interface. If an attacker gains local or remote administrative control, brute‑forcing the static IV can reveal encrypted content.