Fortra · GoAnywhere MFT

CVE-2025-10035

Deserialization Vulnerability in GoAnywhere MFT's License Servlet

Exploited in attacks Used by ransomware Critical 10.0 Attack chance: 99.8%

What it is

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

CISA: Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: October 20, 2025

Added to the CISA list: September 29, 2025
Published: September 18, 2025
Severity: Critical 10.0 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99.8% in the top 0.1% of all known vulnerabilities
Weakness: CWE-502 CWE-77
More details: NVD · CVE.org · CISA

All references (1)

https://www.fortra.com/security/advisories/product-security/fi-2025-012

More exploited flaws from Fortra

Added	Vulnerability	Product	Severity	Attack chance
Feb 10, 2023	Remote Code ExecutionCVE-2023-0669used by ransomware	GoAnywhere MFT	High 7.2	>99.9%
Mar 30, 2023	Teamserver Cross-Site Scripting (XSS)CVE-2022-39197	Cobalt Strike	Medium 6.1	47%
Mar 30, 2023	User Interface Remote Code ExecutionCVE-2022-42948	Cobalt Strike	Critical 9.8	2.7%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.