Security advisories covering Fortra products — including BoKS ServerControl, Cobalt Strike, GoAnywhere, and other enterprise security software acquired under the HelpSystems umbrella. Combined article + CVE feed for the Fortra beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-10-03-fortra-boks-critical-patches/https://0daynews.com/articles/2026-10-03-fortra-boks-critical-patches/Fortra has patched critical vulnerabilities in BoKS ServerControl, its Unix/Linux privileged access management platform. The flaws include authentication bypass, shell command execution, and memory corruption.Sat, 03 Oct 2026 16:30:00 GMTFortraarticlehttps://0daynews.com/cve/cve-2022-39197/https://0daynews.com/cve/cve-2022-39197/Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.Sat, 03 Oct 2026 00:00:00 GMTFortramediumcvehttps://0daynews.com/cve/cve-2022-42948/https://0daynews.com/cve/cve-2022-42948/Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.Sat, 03 Oct 2026 00:00:00 GMTFortracriticalcvehttps://0daynews.com/cve/cve-2023-0669/https://0daynews.com/cve/cve-2023-0669/Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.Sat, 03 Oct 2026 00:00:00 GMTFortrahighcvehttps://0daynews.com/cve/cve-2025-10035/https://0daynews.com/cve/cve-2025-10035/Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.Sat, 03 Oct 2026 00:00:00 GMTFortracriticalcve