Actively exploited · Published Sep 18, 2025 · Assigned by Fortra
CVE-2025-10035Deserialization Vulnerability in GoAnywhere MFT's License Servlet
Critical 10.0 Exploited Ransomware
In plain English
A critical-severity command injection in GoAnywhere MFT from Fortra. Attackers are actively exploiting it in the wild (listed by CISA on September 29, 2025). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Oct 20, 2025.
Official description
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortra | GoAnywhere MFT | 0 – through 7.8.3 |
Weakness: CWE-77, CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H