Hackers exploit Fortra GoAnywhere flaw before public alert

According to watchTowr Labs, hackers exploited the Fortra GoAnywhere MFT flaw, CVE-2025-10035, as early as 10 September 2025, about a week before Fortra’s public advisory was issued. The flaw is a deserialization vulnerability in the License Servlet of GoAnywhere MFT, with a CVSS score of 10.0, and attackers could execute arbitrary commands on affected systems.

Fortra subsequently addressed the vulnerability on 18 September 2025, recommending customers upgrade to the patched version (the latest release 7.8.4, or the Sustain Release 7.6.3) and advising operators to restrict public access to the GoAnywhere Admin Console to mitigate internet-exposed risk. WatchTowr notes that more than 20,000 internet-facing GoAnywhere MFT instances were observed, including those belonging to Fortune 500 organisations.

Rapid7 adds that the issue involves a chain of three bugs, including an access-control bypass and an unsafe deserialization vulnerability, rather than a single flaw. As of late September 2025, there was no widely available exploit code publicly confirmed, though advisories included IOCs to aid defenders.