Critical RCE (CVE-2025-10035) in GoAnywhere MFT Used by Medusa Ransomware Group

Microsoft Threat Intelligence has issued a warning following the discovery of active exploitation of a newly disclosed critical vulnerability in GoAnywhere Managed File Transfer (MFT) software by the cybercriminal group Storm-1175, known for deploying Medusa ransomware and exploiting exposed enterprise applications for initial access.

According to Microsoft, on 18 September 2025 Fortra published a security advisory regarding a critical deserialization vulnerability in GoAnywhere MFT’s License Servlet, tracked as CVE-2025-10035 with a CVSS score of 10.0. The vulnerability allows attackers to execute arbitrary code on unpatched servers in certain cases and affects Admin Console versions up to 7.8.3, arising from improper deserialization of user-supplied input.

Public reports indicate exploitation does not require authentication if attackers can craft or intercept valid license responses. The threat actor Storm-1175, previously observed distributing Medusa ransomware, has quickly adopted the vulnerability in targeted attacks, with exploitation activity beginning as early as 11 September 2025.

In these attacks, they performed initial access, dropped RMM tools, created malicious web shells, and deployed Medusa ransomware, using techniques such as Cloudflare tunnels for C2 and Rclone for exfiltration.