Despite pleas that Fortra's GoAnywhere pay attention to IBM's long notice, well before 7.6 was announced that IBM i 7.5 was the last release to run Java 11,

and, despite pleas that Fortra's GoAnywhere participate in IBM Early Programs and jump right on testing to be ready for IBM i 7.6 when it's announced,

and, despite paying the ransom and going from $1,400/year to $5k/year to be eligible for the release that will run IBM i 7.6,

the latest news I've received is: 

GoAnywhere MFT needs Java 17 or Java 21, which is tentatively planned for MFT 8.0.0 scheduled for the first part of 2026. 
Development is working on this and this schedule may change depending on any issues they may run into.

Java 21 won't run on IBM i 7.4 and likely never will.  I couldn't care less about that though.  A level 8 might be a fine time to drop 7.4.  We'll see if GoAnywhere goes with 21 or 17.  17 has a short life expectancy though.  If it makes it to rNext I'd be surprised.  In that thought, GoAnywhere will likely choose that and leave us waiting another year or so after rNext comes out before they are ready.

I've looked at other products.  IBM was pretty honest with me and said, with our volume, we'd never get their solution through budget.

Despite pleas that Fortra's GoAnywhere pay attention to IBM's long notice, well before 7.6 was announced that IBM i 7.5 was the last release to run Java 11,

and, despite pleas that Fortra's GoAnywhere participate in IBM Early Programs and jump right on testing to be ready for IBM i 7.6 when it's announced,

and, despite paying the ransom and going from $1,400/year to $5k/year to be eligible for the release that will run IBM i 7.6,

the latest news I've received is: 

GoAnywhere MFT needs Java 17 or Java 21, which is tentatively planned for MFT 8.0.0 scheduled for the first part of 2026. 
Development is working on this and this schedule may change depending on any issues they may run into.

Java 21 won't run on IBM i 7.4 and likely never will.  I couldn't care less about that though.  A level 8 might be a fine time to drop 7.4.  We'll see if GoAnywhere goes with 21 or 17.  17 has a short life expectancy though.  If it makes it to rNext I'd be surprised.  In that thought, GoAnywhere will likely choose that and leave us waiting another year or so after rNext comes out before they are ready.

I've looked at other products.  IBM was pretty honest with me and said, with our volume, we'd never get their solution through budget.

Robert, 

I "assume" that this will put some fire under Fortra to deal with GoAnywhere as a matter of priority :

https://labs.watchtowr.com/is-this-bad-this-feels-bad-goanywhere-cve-2025-10035/
https://labs.watchtowr.com/it-is-bad-exploitation-of-fortra-goanywhere-mft-cve-2025-10035-part-2/

fingers crossed

Despite pleas that Fortra's GoAnywhere pay attention to IBM's long notice, well before 7.6 was announced that IBM i 7.5 was the last release to run Java 11,

and, despite pleas that Fortra's GoAnywhere participate in IBM Early Programs and jump right on testing to be ready for IBM i 7.6 when it's announced,

and, despite paying the ransom and going from $1,400/year to $5k/year to be eligible for the release that will run IBM i 7.6,

the latest news I've received is: 

GoAnywhere MFT needs Java 17 or Java 21, which is tentatively planned for MFT 8.0.0 scheduled for the first part of 2026. 
Development is working on this and this schedule may change depending on any issues they may run into.

Java 21 won't run on IBM i 7.4 and likely never will.  I couldn't care less about that though.  A level 8 might be a fine time to drop 7.4.  We'll see if GoAnywhere goes with 21 or 17.  17 has a short life expectancy though.  If it makes it to rNext I'd be surprised.  In that thought, GoAnywhere will likely choose that and leave us waiting another year or so after rNext comes out before they are ready.

I've looked at other products.  IBM was pretty honest with me and said, with our volume, we'd never get their solution through budget.

That is rather unrelated.

GoAnywhere is usually prompt in addressing CVE's.  There's a couple of things to consider in the link you provided.  One, this primarily affected the administration interface.  The administration interface uses a different port number which they stress never to put on the public internet.  They've updated the admin screen to stress that.  They also got a new update right out to promptly smack that around.

Now, if we could only get a CVE generated that said a vendor's software was a hindrance to security because it would not run on a version of OS which comes with MFA with it.

Robert, 

I "assume" that this will put some fire under Fortra to deal with GoAnywhere as a matter of priority :

https://labs.watchtowr.com/is-this-bad-this-feels-bad-goanywhere-cve-2025-10035/
https://labs.watchtowr.com/it-is-bad-exploitation-of-fortra-goanywhere-mft-cve-2025-10035-part-2/

fingers crossed

Despite pleas that Fortra's GoAnywhere pay attention to IBM's long notice, well before 7.6 was announced that IBM i 7.5 was the last release to run Java 11,

and, despite pleas that Fortra's GoAnywhere participate in IBM Early Programs and jump right on testing to be ready for IBM i 7.6 when it's announced,

and, despite paying the ransom and going from $1,400/year to $5k/year to be eligible for the release that will run IBM i 7.6,

the latest news I've received is: 

GoAnywhere MFT needs Java 17 or Java 21, which is tentatively planned for MFT 8.0.0 scheduled for the first part of 2026. 
Development is working on this and this schedule may change depending on any issues they may run into.

Java 21 won't run on IBM i 7.4 and likely never will.  I couldn't care less about that though.  A level 8 might be a fine time to drop 7.4.  We'll see if GoAnywhere goes with 21 or 17.  17 has a short life expectancy though.  If it makes it to rNext I'd be surprised.  In that thought, GoAnywhere will likely choose that and leave us waiting another year or so after rNext comes out before they are ready.

I've looked at other products.  IBM was pretty honest with me and said, with our volume, we'd never get their solution through budget.