2510 
This vulnerability involves an out-of-bounds memory read in the Globalscape administration server. If successfully exploited, an attacker could crash the service or bypass authentication entirely. The theoretical impact of CVE-2023-2989 is remote code execution as the SYSTEM user.
Resolved issues where incorrect email reminders were sent regarding expiring SSL certificates.
CVE-2023-2991 Severity: MEDIUM (CVSS 5.3) Disclosure Date: June 22, 2023
What of Globalscape EFT are you currently running? globalscape terms patched
Fixes addressed issues where EFT would fail to establish DMZ connections using the REST API protocol.
Disclaimer: This article is based on information available as of early June 2026. Security landscapes change rapidly; always consult the official Fortra/Globalscape documentation and release notes for the most up-to-date patch information.
The patch was released for multiple versions, including the 8.3.2.568 and 8.3.0.412 releases. This vulnerability involves an out-of-bounds memory read in
A resource exhaustion flaw triggered by a recursive DeflateStream , allowing an unauthenticated attacker to crash the server remotely.
Discovered around the same time, CVE-2023-2990 presented a different type of risk: a Denial of Service (DoS) vulnerability. This flaw existed because of improper handling of a recursively compressed packet. An unauthenticated, remote attacker could send a specially crafted packet to the server, causing it to crash. This patch, included in the same version 8.1.0.16, was critical for maintaining business uptime. While not a data breach, a DoS attack could have significant business consequences.
In older instances of EFT Event Rules, file manipulation utilities faced exposure to a known "Zip Slip" directory traversal vulnerability. If left unpatched, malicious archive uploads could overwrite sensitive configuration files outside the intended target directory. Fortra delivered architectural validation patches to secure archive extraction directories. CVE-2023-2989: Globalscape EFT Server Auth Bypass Flaw Resolved issues where incorrect email reminders were sent
As of the time of this writing, Globalscape operates as part of , bringing additional resources and security expertise to the patching process. The company’s security practices include:
Open Windows Services ( services.msc ) and the EFT Server Service .
Patching Globalscape EFT in 2026 also brings improvements in functionality, reducing operational bottlenecks: