This vulnerability (CVE-2025-14362) affects Fortra GoAnywhere MFT versions before 7.10.0. It involves improper restriction of excessive authentication attempts (CWE-307) on the SFTP service when a web user is configured to authenticate using an SSH key. Because the login limit is not enforced, an attacker can perform brute force attacks against SSH keys, potentially compromising the key and gaining unauthorized access. The CVSS 3.1 score is 7.3 (high), with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

An attacker can attempt unlimited authentication attempts against SSH keys on the SFTP service, increasing the risk of successful brute force attacks. Successful exploitation could lead to unauthorized access to the system, potentially compromising data confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider additional protective measures such as monitoring for unusual authentication attempts and restricting network access to the SFTP service where possible. Avoid using vulnerable versions of GoAnywhere MFT or disable SSH key authentication if feasible until a patch is released.