CVE-2025-10035
Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability
Description
CVE-2025-10035 is a critical deserialization and command injection vulnerability in Fortra GoAnywhere MFT (Managed File Transfer), a widely used enterprise file transfer solution. The vulnerability exists in the License Servlet, where an attacker with a validly forged license response signature can deserialize an arbitrary attacker-controlled object, leading to command injection. With the maximum possible CVSS v3.1 base score of 10.0 and confirmed ransomware exploitation, CVE-2025-10035 represents one of the most dangerous file transfer vulnerabilities disclosed. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 20, 2025, and its EPSS score of 61.55% at the 98th percentile confirms extremely high exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| fortra | goanywhere managed file transfer | < 7.6.3; >= 7.7.0, < 7.8.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.fortra.com/security/advisories/product-security/fi-2025-012(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10035(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2025-10035 involves CWE-502 (Deserialization of Untrusted Data), where the GoAnywhere MFT License Servlet deserializes attacker-controlled objects from forged license responses without sufficient validation. The deserialization process instantiates arbitrary objects that can trigger malicious operations, serving as the entry point for the command injection chain.
Learn more: CWE-502 — Deserialization of Untrusted Data
CWE-77: Command Injection
CVE-2025-10035 also involves CWE-77 (Improper Neutralization of Special Elements used in a Command). The deserialized objects lead to command injection, where attacker-supplied data is incorporated into system commands without proper sanitization, enabling arbitrary command execution on the GoAnywhere MFT server.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection')
Impact Analysis
CVE-2025-10035 represents the maximum possible security risk, with a perfect CVSS score of 10.0. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). The scope is changed (S:C), meaning the exploit can affect resources far beyond the GoAnywhere MFT server itself. Confidentiality (High): An attacker achieving command execution on a file transfer server can access all files being transferred, including highly sensitive business documents, financial data, healthcare records, and personally identifiable information. GoAnywhere MFT is specifically designed to handle regulated and sensitive file transfers. Integrity (High): The attacker can modify files in transit, alter transfer configurations, inject malicious content into transferred files, and manipulate audit logs. Availability (High): The attacker can disrupt all file transfer operations, which are often critical to business processes in regulated industries. With confirmed ransomware exploitation and an EPSS score of 61.55% at the 98th percentile, this GoAnywhere MFT vulnerability is among the most actively exploited vulnerabilities currently tracked. File transfer appliances have become prime targets following similar campaigns against MOVEit, Accellion, and previous GoAnywhere vulnerabilities.
Exploit Maturity
CVE-2025-10035 demonstrates maximum exploit maturity with confirmed active exploitation and ransomware usage. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, and critically, ransomware campaigns are known to exploit this vulnerability, making it one of the highest-priority vulnerabilities for all affected organizations. The EPSS score of 61.55% at the 98th percentile places it in the top 2% of all vulnerabilities by exploitation probability. The Fortra security advisory at fi-2025-012 provides the official vendor disclosure. GoAnywhere MFT has been a previous target of major ransomware groups, with the Cl0p ransomware gang's exploitation of CVE-2023-0669 resulting in data breaches affecting over 130 organizations. The pattern of targeting managed file transfer solutions for mass data exfiltration and extortion makes CVE-2025-10035 an immediate critical priority.
Remediation
-
Upgrade GoAnywhere MFT immediately to a patched version. Update to version 7.6.3 or later for installations on the pre-7.7 branch, or version 7.8.4 or later for installations on the 7.7.x-7.8.x branch. The Fortra advisory at fi-2025-012 provides upgrade guidance. The CISA required action states to apply mitigations per vendor instructions or discontinue use of the product.
-
Restrict access to the License Servlet as an immediate compensating control. Block external access to the GoAnywhere MFT administrative and license management interfaces using firewall rules or WAF policies. Limit access to the License Servlet endpoint to trusted management networks only.
-
Conduct forensic investigation before and after patching. Given the confirmed ransomware association, assume any internet-exposed GoAnywhere MFT instance running a vulnerable version has been compromised. Review system logs, network traffic captures, and file transfer audit logs for indicators of unauthorized access, data exfiltration, and malware deployment.
-
Assess data exposure and initiate incident response procedures if compromise is suspected. Identify all files that were stored on or transferred through the GoAnywhere MFT instance. Notify affected data owners and regulatory bodies as required. Rotate all credentials, certificates, and encryption keys associated with the GoAnywhere MFT installation.
-
Implement enhanced file transfer security as a long-term measure. Deploy network-level monitoring to detect anomalous file transfer patterns. Implement multi-factor authentication for GoAnywhere MFT administrative access. Maintain the GoAnywhere MFT instance on a hardened, segmented network. Subscribe to Fortra security advisories and apply patches promptly, given the pattern of recurring file transfer appliance vulnerabilities.
Technical Details
CVE-2025-10035 is a combined deserialization and command injection vulnerability in Fortra GoAnywhere MFT's License Servlet. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H achieves the maximum base score of 10.0, reflecting network exploitation with no complexity, no authentication, no user interaction, changed scope, and maximum CIA impact. The vulnerability chain begins with CWE-502 (Deserialization of Untrusted Data) in the License Servlet. GoAnywhere MFT's license validation mechanism processes serialized Java objects from license responses. An attacker who can forge a valid license response signature can submit a malicious serialized object to the License Servlet. During deserialization, the malicious object triggers a gadget chain that leads to CWE-77 (Command Injection), where attacker-controlled data is executed as system commands. The changed scope (S:C) reflects that the initial vulnerability in the License Servlet leads to system-wide compromise, potentially affecting the entire hosting infrastructure and any connected systems. Affected versions include GoAnywhere MFT before 7.6.3 and versions 7.7.0 through 7.8.3.
Frequently Asked Questions
Is CVE-2025-10035 being actively exploited?
Yes. CISA has confirmed active exploitation and ransomware campaigns are known to exploit this vulnerability. The EPSS score of 61.55% at the 98th percentile confirms extremely high exploitation activity. GoAnywhere MFT has been a previous target of major ransomware groups, and CVE-2025-10035 follows the same pattern of targeting file transfer appliances.
What products are affected by CVE-2025-10035?
Fortra GoAnywhere MFT versions before 7.6.3 and versions 7.7.0 through 7.8.3 are affected. The vulnerability is in the License Servlet component. All organizations running these versions should treat this as an emergency patching priority.
How do I fix CVE-2025-10035?
Upgrade to GoAnywhere MFT version 7.6.3 or later (for pre-7.7 installations) or version 7.8.4 or later (for 7.7.x-7.8.x installations). As an immediate measure, restrict all external access to the GoAnywhere MFT administrative and license management interfaces.
How severe is CVE-2025-10035?
CVE-2025-10035 has the maximum CVSS v3.1 base score of 10.0 out of 10. The vulnerability allows unauthenticated remote attackers to achieve command execution through deserialization and command injection, with changed scope affecting resources beyond the GoAnywhere MFT server. Confirmed ransomware exploitation makes this one of the most urgent vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.