CVE-2025-10035: Fortra GoAnywhere MFT deserialization to command injection, actively exploited
The short version: Fortra's GoAnywhere MFT has a deserialization flaw in its License Servlet (CVE-2025-10035): an attacker who can forge a valid license-response signature can deserialize an arbitrary object and drive it into command injection on the server. Fortra scores it a perfect 10.0, it's in CISA's KEV catalog, and it was exploited as a zero-day by a ransomware operator. Patch now. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS (Fortra, CNA) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (Scope: Changed) |
| EPSS | ~99.6% · 99.95th percentile (2026-07-17) |
| In CISA KEV? | Yes — added 2025-09-29; remediation was due 2025-10-20 |
| Known exploited? | Yes — exploited as a zero-day; attributed to ransomware activity (Storm-1175 / Medusa) |
| Vulnerability type | CWE-502 deserialization of untrusted data → command injection |
| Requires authenticated session? | No — exploited without valid credentials via a forged license-response signature |
| Affected | GoAnywhere MFT prior to 7.6.3, and 7.7.0 through 7.8.3 |
| Fixed in | GoAnywhere MFT 7.8.4 (latest) and 7.6.3 (Sustain Release) |
What you need to know
CVE-2025-10035 lives in the GoAnywhere License Servlet. An actor who can present a validly forged license-response signature can get the servlet to deserialize an attacker-controlled object — and that deserialization is the doorway to command injection on the underlying server.
- How they find it — internet-wide scanning surfaces exposed GoAnywhere MFT interfaces.
- How they use it — forge the license-response signature, feed a malicious serialized object to the servlet, and reach command execution; exploitation ran as a zero-day before the advisory.
- What it leads to — code execution on a file-transfer platform holding sensitive data — the exact recipe that made GoAnywhere a repeat target for extortion crews.
How serious we see it
High — the 10.0 matches the field reports.
Network-reachable command injection on an internet-facing MFT platform, exploited as a zero-day and tied to ransomware, is top-of-queue. Fortra's 10.0 (Scope: Changed) reflects that a compromise reaches beyond the servlet's own boundary; NVD's 9.8 lands in the same Critical band. The bounded, reassuring part: specific versions are affected, fixes exist on both the latest and Sustain branches, and exposure is quick to determine. The catch is the pre-patch window — check for compromise, because a patched server isn't automatically a clean one.
Recommendations
Straight from Fortra's advisory (FI-2025-012) and CISA:
- Patch now. Upgrade to GoAnywhere MFT 7.8.4 (latest) or 7.6.3 (Sustain) or later.
- Get the admin console and license endpoint off the public internet. Restrict access to trusted networks — GoAnywhere's history argues strongly for this.
- Hunt for prior compromise. Given the zero-day window, review the server for unexpected processes, files, accounts, and outbound connections.
- If you find indicators, respond fully. Rebuild where warranted, rotate credentials and keys, and assess what data was reachable.
- Confirm your exposure first. Verify whether any GoAnywhere MFT is internet-facing and on an affected build.
How BreachRisk sees it
BreachRisk discovers internet-facing GoAnywhere MFT portals from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed, actively exploited flaws like this one — surfaced at the top of your results because it's in KEV. Where authorized, it goes beyond detection and safely performs a bounded, non-disruptive check against the affected endpoint to confirm it responds as a vulnerable instance would, rather than attempting the command injection itself.
That outside-in, continuous view is exactly what an actively exploited MFT flaw demands: the exposed platform is already mapped and ranked, so you go straight to patch-and-hunt.