Fortra has recently addressed a critical security vulnerability in its FileCatalyst Workflow software, which presents a severe risk to users due to a hardcoded password flaw. This vulnerability, tracked as CVE-2024-6633 (CVSS score 9.8/10), enables remote attackers to gain unauthorized access to an internal HyperSQL database (HSQLDB) through TCP port 4406, a default setting in the software. By exploiting this flaw, attackers can potentially access sensitive information stored in the database and even create new admin-level users, granting them complete control over the FileCatalyst Workflow application. This issue affects all versions of FileCatalyst Workflow up to and including version 5.1.6 Build 139 and was first identified by Tenable. Tenable discovered that the static password “GOSENSGO613” is hardcoded across all deployments and cannot be changed by users through conventional means. This makes the vulnerability particularly dangerous as it leaves systems exposed to significant exploitation risks. The HSQLDB, which is only intended to facilitate the installation process and is not meant for production use, remains vulnerable if users do not configure an alternative database as recommended by Fortra. Recognizing the severity of the situation, Fortra has released an urgent patch in version 5.1.7, which not only addresses CVE-2024-6633 but also fixes a high-severity SQL injection vulnerability (CVE-2024-6632) that could allow unauthorized modifications to the database during the setup process. Given the high level of access this flaw could provide to cybercriminals and the lack of available mitigations or workarounds, CTIX analysts strongly advises all users to upgrade to the latest version immediately to defend their systems from potential attacks. This situation underscores the importance of adhering to security best practices and promptly applying patches to prevent large-scale compromises, particularly in environments where Fortra products are used, as these are often targeted by attackers due to their critical roles in corporate networks.