GoAnywhere MFT - Authentication Bypass (CVE-2024-0204)

CVE-2024-0204 is a critical authentication bypass vulnerability in Fortra's GoAnywhere MFT prior to version 7.4.1, allowing unauthorized users to create admin accounts through the administration portal. This flaw could enable attackers to gain full administrative control over the system, leading to potential data breaches, system manipulation, and further exploitation of sensitive information.

CrowdSec has been tracking this vulnerability and its exploits since 25th of September 2025.

CrowdSec network data shows that most actors exploiting CVE-2024-0204 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-0204 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit authentication bypass by sending requests to URLs containing /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml, allowing unauthorized creation of administrator accounts on Fortra GoAnywhere MFT systems.