GoAnywhere 0-Day RCE Actively Exploited to Deliver Medusa Ransomware

According to Fortra, a critical zero-day vulnerability in GoAnywhere MFT’s License Servlet—CVE-2025-10035—was disclosed on 18 September 2025, with a perfect CVSS score of 10.0, and threat actors tracked as Storm-1175 have abused the flaw to gain remote code execution on exposed systems. CVE-2025-10035 affects GoAnywhere MFT versions up to 7.8.3, enabling an attacker to forge a license response signature and trigger deserialization of attacker-controlled objects, leading to command injection and full RCE.

Microsoft Threat Intelligence identified active exploitation beginning 11 September 2025, with Storm-1175 deploying multi-stage techniques that include dropping SimpleHelp and MeshAgent, deploying web shells, mapping environments, and using RMM tools for persistence and control before encrypting systems with Medusa ransomware.

Mitigation guidance urges upgrading GoAnywhere MFT to the patched version, restricting outbound traffic, deploying EDR in block mode, and employing external attack surface management and vulnerability management to detect and respond to exploitation attempts.