# Fortra vulnerabilities & exploitation **CISA KEV** · **Ransomware** > As of 2026-10-23, Threadlinqs tracks 7 Fortra CVEs, 2 in the CISA Known Exploited Vulnerabilities catalog, 2 used in ransomware campaigns, linked to 6 tracked threat campaigns and 4 named threat actors. **Data as of:** 2026-10-23 ## Exploitation timeline Threadlinqs has recorded 7 Fortra CVEs published between 2023-02-15 and 2026-10-15. The busiest month was 2026-10 (3 new CVEs). 2 of them (29%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 7 of 7 tracked Fortra CVEs. - [CVE-2023-0669](https://intel.threadlinqs.com/cve/CVE-2023-0669) — HIGH 7.2 · KEV · Ransomware · EPSS 100% · 2023-02-06 - [CVE-2025-10035](https://intel.threadlinqs.com/cve/CVE-2025-10035) — CRITICAL 10 · KEV · Ransomware · EPSS 99.8% · 2025-09-18 - [CVE-2026-9862](https://intel.threadlinqs.com/cve/CVE-2026-9862) — CRITICAL 9.8 · EPSS 1.5% · 2026-06-15 - [CVE-2026-9863](https://intel.threadlinqs.com/cve/CVE-2026-9863) — HIGH 7.5 · EPSS 1% · 2026-06-15 - [CVE-2026-79898](https://intel.threadlinqs.com/cve/CVE-2026-79898) — CRITICAL 9.1 · EPSS 1% · 2026-10-01 - [CVE-2026-12627](https://intel.threadlinqs.com/cve/CVE-2026-12627) — CRITICAL 9.8 · EPSS 0.4% · 2026-10-01 - [CVE-2026-79901](https://intel.threadlinqs.com/cve/CVE-2026-79901) — CRITICAL 9.9 · EPSS 0.3% · 2026-10-01 ## Products affected Threadlinqs normalises CPE and CNA product records across all 7 CVEs; 6 distinct Fortra products are affected. The most frequently affected: - Core Privileged Access Manager (BoKS) — 2 CVEs - BoKS Manager — 1 CVE - BoKS Manager boks-server — 1 CVE - Fortra's Core Privileged Access Manager (BoKS) — 1 CVE - Goanywhere MFT — 1 CVE - Goanywhere Managed File Transfer — 1 CVE ## Threat activity 6 tracked threat campaigns reference Fortra products or exploit Fortra CVEs: - [Cl0p Ransomware MFT Attack Pattern: Multi-Year Zero-Day Campaigns Against File Transfer and Enterprise Software (2020-2025)](https://intel.threadlinqs.com/threat/TL-2026-3070) — HIGH — 2026-10-09 - [Fortra Patches Critical Vulnerabilities in BoKS Privileged Access Manager (CVE-2026-79901, CVE-2026-79898, CVE-2026-12627)](https://intel.threadlinqs.com/threat/TL-2026-2854) — CRITICAL — 2026-10-03 - [LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)](https://intel.threadlinqs.com/threat/TL-2026-2094) — HIGH — 2026-08-21 - [Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands](https://intel.threadlinqs.com/threat/TL-2026-1710) — MEDIUM — 2026-07-22 - [CVE-2026-9862: Unauthenticated OS Command Injection in Fortra Core Privileged Access Manager (BoKS) boks_autoregisterd](https://intel.threadlinqs.com/threat/TL-2026-0885) — CRITICAL — 2026-06-20 - [Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign (CVE-2026-23760, CVE-2025-10035)](https://intel.threadlinqs.com/threat/TL-2026-0326) — CRITICAL — 2026-04-06 ## Threat actors targeting Fortra Named threat actors attributed to campaigns that involve Fortra products or CVEs, with the number of linked campaigns: - [LockBit](https://intel.threadlinqs.com/actor/LockBit) — 2 campaigns - [Cl0p](https://intel.threadlinqs.com/actor/Cl0p) — 1 campaign - [Nitrogen](https://intel.threadlinqs.com/actor/Nitrogen) — 1 campaign - [Storm-1175](https://intel.threadlinqs.com/actor/Storm-1175) — 1 campaign ## How to prioritise Fortra patching This order follows the data Threadlinqs holds for Fortra, not a generic severity checklist: - 2 of 7 Fortra CVEs (29%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2023-0669](https://intel.threadlinqs.com/cve/CVE-2023-0669), [CVE-2025-10035](https://intel.threadlinqs.com/cve/CVE-2025-10035). - 2 CVEs are known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems. - Outside KEV, the highest EPSS scores are [CVE-2026-9862](https://intel.threadlinqs.com/cve/CVE-2026-9862) (1.5%), [CVE-2026-9863](https://intel.threadlinqs.com/cve/CVE-2026-9863) (1%), [CVE-2026-79898](https://intel.threadlinqs.com/cve/CVE-2026-79898) (1%). - 5 CVEs score Critical and 2 High on CVSS v3 (maximum 10, average 9); sequence these after KEV and high-EPSS items. - 2 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-23 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/fortra All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp