Fortra Releases Critical Patch for CVSS 10.0 GoAnywhere MFT Vulnerability

Fortra has disclosed a critical vulnerability in GoAnywhere MFT, tracked as CVE-2025-10035, with a CVSS score of 10.0, the highest severity rating. The flaw is a deserialization vulnerability in the License Servlet that could allow an actor with a forged license response signature to deserialize an arbitrary object and potentially inject commands, according to Fortra's advisory.

Exploitation is possible only if the affected system is publicly accessible over the internet, the company notes, and users are urged to update to the patched release—version 7.8.4, or the Sustain Release 7.6.3. If immediate patching is not feasible, access to the GoAnywhere Admin Console should not be exposed publicly.

Fortra's advisory adds that previous disclosures in the GoAnywhere MFT line, such as CVE-2023-0669 and CVE-2024-0204, have been discussed in the past, with warnings from threat intelligence sources about potential in-the-wild exploitation. according to Fortra's GoAnywhere MFT advisory