CVE-2025-10035

Published Sep 18, 2025

Last updated a month ago

Fortra

GoAnywhere

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-10035 is a deserialization vulnerability found in the License Servlet of Fortra's GoAnywhere MFT. It allows an attacker with a validly forged license response signature to deserialize an arbitrary, attacker-controlled object. This could potentially lead to command injection. To remediate this vulnerability, it is recommended to update GoAnywhere MFT to version 7.8.4. It is also advised to ensure that access to the GoAnywhere Admin Console is not open to the public, as exploitation of this vulnerability is highly dependent on systems being externally exposed to the internet.

Description: A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
Source: df4dee71-de3a-4139-9588-11b62fe6c0ff
NVD status: Analyzed
Products: goanywhere_managed_file_transfer

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
Exploit added on: Sep 29, 2025
Exploit action due: Oct 20, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

df4dee71-de3a-4139-9588-11b62fe6c0ff: CWE-77
nvd@nist.gov: CWE-77

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CF143971-7546-4C90-B0D0-A3E08536BF4F",
            "versionEndExcluding": "7.6.3"
          },
          {
            "criteria": "cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "479CA63D-4C41-4CA1-9655-A8BD43311CEA",
            "versionEndExcluding": "7.8.4",
            "versionStartIncluding": "7.7.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.