CVE-2025-10035

Description

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 10.0CVSS 3.1, Criticalfrom the CNA (Fortra)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What to do

• Upgrade to a patched version (the latest release 7.8.4, or the Sustain Release 7.6.3)CNA solution statement
• Immediately ensure that access to the GoAnywhere Admin Console is not open to the public. Exploitation of this vulnerability is highly dependent upon systems being externally exposed to the internet.CNA workaround statement
• Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-248 Command Injection (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 18 Sep 2025 Published
2. 29 Sep 2025 CVE-2025-10035 added to CISA KEV
3. 29 Sep 2025 Added to the CISA KEV catalogue

Weakness

• CWE-77
• CWE-502

References

• www.fortra.com