This vulnerability (CVE-2025-1241) involves inadequate encryption strength due to the use of a static IV in Fortra GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0. The static IV undermines the encryption scheme, enabling admin users to brute-force decrypt encrypted data. The CVSS 3.1 base score is 5.8, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction. The vulnerability impacts confidentiality but not integrity or availability. No vendor advisory or patch information is currently provided.

The vulnerability allows administrative users to brute-force decrypt encrypted data due to weak encryption practices (static IV). This compromises the confidentiality of sensitive data handled by the affected versions of GoAnywhere MFT and Agents. There is no indication that integrity or availability are affected. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for unusual activity related to encrypted data handling. Avoid using affected versions in sensitive environments if possible.