CVE-2025-10035criticalunder attackransomwareCWE-502CWE-77

CVE-2025-10035: critical vulnerability in Fortra GoAnywhere MFT

Deserialization Vulnerability in GoAnywhere MFT's License Servlet

Published · Updated

Follow this CVE+ Monitor GoAnywhere MFT

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 10epss 100%
from disclosure to weapon2 days
Published on NVDSep 18
1st PoC+2d
CISA KEV+11d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

Ransomwaremedusa CISA
Action required by CISAfederal deadline: 2025-10-20

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

GoAnywhere MFT contains a flaw that allows someone with a forged license to inject and run malicious commands on the server. This happens because the software unsafely processes untrusted data without proper validation.

Technical detail

The License Servlet in GoAnywhere MFT deserializes untrusted objects (CWE-502) without adequate validation, enabling command injection (CWE-77) when an attacker crafts a malicious license response with a valid forged signature. Pre-condition requires ability to generate a valid signature; impact includes arbitrary code execution with application privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Fortra · GoAnywhere MFT
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Fortra GoAnywhere MFT

In the same product, most dangerous first.

CVE-2024-0204CRITICALAuthentication Bypass in GoAnywhere MFTEPSS 95.1%CVE-2024-25157MEDIUMAuthentication bypass in GoAnywhere MFT prior to 7.6.0EPSS 0.5%CVE-2026-15913HIGHPath Traversal in Fortra's GoAnywhere MFT EndpointEPSS 0.4%CVE-2024-25156MEDIUMPath traversal in GoAnywhere MFT 7.4.1 and EarlierEPSS 0.4%CVE-2025-3871MEDIUMBroken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlierEPSS 0.4%CVE-2024-9945MEDIUMLimited Information Disclosure in GoAnywhere MFT Prior to 7.7.0EPSS 0.3%