CVE-2026-1089

CVE-2026-1089 is a user-controlled HTTP header vulnerability in Fortra's GoAnywhere MFT versions prior to 7.10.0 that permits attackers to initiate DNS lookups and execute DNS rebinding attacks, potentially leading to information disclosure. The vulnerability presents a network-based attack vector requiring no authentication or user interaction, with a CVSS score of 6.5 (Medium severity) that carries low confidentiality and availability impacts. Current exploitation appears minimal, with no active entries on the CISA Known Exploited Vulnerabilities (KEV) catalog, no reported public exploit code, and an EPSS score of 0.00041 indicating very low probability of active exploitation in the wild. The vulnerability maintains an inactive status on threat tracking lists and carries a FAUCET Risk Score of 35.0 out of 100, suggesting moderate but not critical priority for patching efforts. Organizations operating Fortra GoAnywhere MFT should prioritize updating to version 7.10.0 or later as part of routine patch management activities.