What’s Vulnerable › Vulnerabilities

CVE-2025-10035: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-09-29
• EPSS: 99.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-18 · updated 2026-10-18
• Weakness: CWE-77

Description

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Affected products

• Fortra GoAnywhere MFT: before 7.6.3; from 7.7.0 before 7.8.4 — fixed in 7.6.3, 7.8.4

How to fix

Upgrade to a fixed version: Fortra GoAnywhere MFT 7.6.3, 7.8.4. Check the vendor advisory for mitigations.

References

• https://www.fortra.com/security/advisories/product-security/fi-2025-012
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10035

Get alerted when CVE-2025-10035 or the next vulnerability affects your stack