Recent Fortra GoAnywhere MFT Vulnerability Exploited as Zero-Day

Eight days before patches were issued, a threat actor exploited CVE-2025-10035 in Fortra GoAnywhere MFT as a zero-day to create a backdoor admin account, SecurityWeek reports. The vulnerability, described as a deserialization flaw in the license servlet, allowed remote code execution without authentication when a forged license signature was accepted, enabling threat actors to deploy further payloads.

Fortra fixed the defect on 18 September, after indications that exploitation had begun at least a week earlier and that the issue had been exploited as a zero-day since 11 September; watchTowr notes that credible in-the-wild activity dated back to 10 September. Analysts from Rapid7 describe the flaw as a triad of issues, including an access-control bypass known since 2023 and an unsafe deserialization chain, with questions still surrounding the private key needed to forge signatures.

The scale of exposure is highlighted by watchTowr’s observation of more than 20,000 GoAnywhere MFT instances accessible from the internet, including deployments for Fortune 500 companies. According to watchTowr, Fortra was eight days late with its patches, and exploitation relied on the system being externally exposed to the internet.