The vulnerability identified as CVE-2026-0972 affects Fortra GoAnywhere MFT versions before 7.10.0. It involves improper restriction of excessive authentication attempts (CWE-307) on the SFTP service when users authenticate using SSH keys. Specifically, the system fails to enforce login attempt limits, enabling brute force attacks against SSH keys. This can lead to unauthorized access if an attacker successfully guesses a valid SSH key. The CVSS 3.1 base score is 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to brute force SSH keys used for authentication on the SFTP service, potentially leading to unauthorized access to the system. This could compromise confidentiality, integrity, and availability of the affected system. However, there are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor Fortra's advisories for updates. Until a fix is available, consider limiting exposure of the SFTP service to trusted networks and implementing additional external controls to detect or block brute force attempts.