CVE-2025-10035 (CVSS 10): Critical Deserialization Flaw in GoAnywhere MFT Exposes Enterprises to Remote Exploitation

CVE-2025-10035 (CVSS 10) is a newly disclosed deserialization flaw in Fortra’s GoAnywhere MFT, carrying the maximum CVSS score of 10.0, and the issue resides in the product’s License Servlet, posing a severe risk to organisations that expose their GoAnywhere Admin Console to the internet.

According to the advisory, “a deserialization vulnerability in the License Servlet of Fortra’s GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.” In practice, a determined attacker could execute arbitrary code on vulnerable systems, effectively hijacking critical file transfer infrastructure.

Exploitation is heavily dependent on external exposure, with systems having the Admin Console publicly reachable to the internet at the highest risk. Fortra has released GoAnywhere MFT version 7.8.4 and Sustain Release 7.6.3 to address the vulnerability, and all organisations using affected versions are urged to upgrade immediately.

As immediate precautionary steps, administrators should ensure the Admin Console is not open to the public, place the service behind a firewall or VPN, and monitor logs for suspicious activity involving license validation processes.