The vulnerability originates from a user‑controlled HTTP header in older releases of Fortra's GoAnywhere MFT. By supplying a specially crafted header, an attacker can cause the server to perform DNS lookups against arbitrary domain names. This can lead to DNS rebinding attacks and leakage of internal host information. The weakness is a form of CWE‑74, reflecting inadequate validation or encoding of external input. In practice, an adversary could determine internal IP addresses or exploit other components that rely on DNS resolution, leading to information disclosure or facilitating further attacks.

Fortra GoAnywhere MFT versions prior to 7.10.0 are impacted. Users should verify their installed version and upgrade to the remediated release.

The CVSS score of 6.5 denotes a moderate severity. Exploitation requires the attacker to send HTTP requests with a manipulated header to the MFT server; therefore, it is limited to network‑reachable endpoints. As EPSS information is unavailable, the attack probability cannot be quantified, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no public exploitation is known. Nonetheless, because DNS rebinding can expose internal systems, administrators should treat this as a risk that can be mitigated by patching.