Fortra Patches Critical GoAnywhere MFT Vulnerability

Fortra has released patches for a critical vulnerability in its GoAnywhere MFT software, tracked as CVE-2025-10035 with a CVSS score of 10, described as a deserialization of untrusted data issue that could enable command injection.

According to Fortra’s advisory, the flaw could be exploited by an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection, and Rapid7 warns that successful exploitation could allow unauthenticated attackers to achieve remote code execution on vulnerable instances.

The patches are included in GoAnywhere MFT version 7.8.4 and GoAnywhere MFT Sustain version 7.6.3, and customers are urged to ensure that the GoAnywhere Admin Console is not publicly accessible. Exploitation is said to be highly dependent on systems being externally exposed to the internet, and Fortra also advises monitoring Admin Audit logs and inspecting log files for errors containing the SignedObject[.]getObject: string in exception stack traces.

The article notes that there has been no public evidence of active exploitation at the time, though Rapid7 emphasises the potential severity, with historical context referencing a prior 2023 zero-day in Fortra’s file transfer product linked to Cl0p.