From Detection to Patch: Fortra Reveals Full Timeline of CVE-2025-10035 Exploitation

Fortra has outlined a full timeline showing CVE-2025-10035 being actively exploited in GoAnywhere MFT since at least 11 September 2025, after a customer reported a potential vulnerability and the firm began its investigation that day. The company said it contacted on‑premises customers whose admin consoles were publicly accessible and notified law enforcement on the same day.

A hotfix covering versions 7.6.x, 7.7.x, and 7.8.x was released the following day, with full patch releases 7.6.3 and 7.8.4 becoming available on 15 September 2025, and three days later the CVE was formally published. Fortra emphasised that the risk is limited to customers with an admin console exposed to the public internet, while noting only a limited number of reports of unauthorized activity related to CVE-2025-10035.

Microsoft revealed that Storm-1175 has been exploiting the flaw since 11 September to deploy Medusa ransomware, a claim that underscores the reality of the vulnerability beyond theory, though Fortra has not clarified how attackers obtained the private keys needed to exploit it.