Patch Now: Max-Severity Fortra GoAnywhere Bug Allows Command Injection

Fortra has released security updates for a maximum severity vulnerability in GoAnywhere MFT’s License Servlet, tracked as CVE-2025-10035, with the highest possible CVSS score of 10 out of 10. If exploited, the advisory notes that a threat actor with a validly forged license response signature could deserialize an arbitrary actor-controlled object, possibly leading to command injection, according to Fortra’s advisory.

Fortra said the flaw was first discovered on 11 September, but the advisory does not specify by whom. The vulnerability is addressed in either the latest GoAnywhere release, version 7.8.4, or the Sustain Release, 7.6.3. Exploitation of this vulnerability is highly dependent upon systems being externally exposed to the Internet, Fortra states. GoAnywhere MFT is a software product designed to help businesses securely transfer files.