The SFTP service of Fortra's GoAnywhere MFT does not enforce a login limit for Web Users who authenticate with an SSH key in versions prior to 7.10.0. This omission allows an attacker to attempt numerous SSH key guesses until a valid key is found, effectively bypassing authentication. The vulnerability is a classic case of authentication bypass (CWE-307) and can result in unauthorized access, data theft, or further lateral movement within the network.

All Fortra GoAnywhere MFT installations with Web Users configured for SSH key authentication that run versions older than 7.10.0 are affected. The vulnerability is limited to the SFTP service and requires the specific user configuration described above.

The CVSS score of 7.3 classifies this as a high‑severity issue. With no EPSS data, the baseline exploit probability is unknown, but the fact that a brute‑force login can succeed without additional preconditions raises concern. The vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation. The likely attack vector is remote, network‑based brute force of SSH keys against the SFTP port, targeting users whose accounts are mistakenly configured to allow key login without login limits.