The vulnerability allows an attacker to bypass the login attempt limit on the SFTP service of Fortra's GoAnywhere MFT when the targeted web user is configured for SSH key authentication. The lack of enforcement means a brute‑force attack can guess the SSH key and gain unauthorized access. This weakness is classified as CWE‑307, which concerns an authentication mechanism that does not properly enforce a maximum number of failed login attempts.

All installations of Fortra GoAnywhere MFT older than version 7.10.0 are affected. The vulnerability exists in the SFTP service layer and therefore any web user configured to use an SSH key is at risk.

With a CVSS score of 7.3, the vulnerability is considered high severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network access to the SFTP port, where an attacker can repeatedly attempt authentication using guessed SSH keys. No special privileges or prior access are required, making exploitation straightforward for attackers with network access to the host.