Fortra GoAnywhere CVSS 10 Flaw Exploited as 0-Day a Week Before Public Disclosure

According to watchTowr, credible evidence exists of active exploitation of the CVSS 10.0 flaw in Fortra GoAnywhere MFT as early as 10 September 2025, a full week before public disclosure. The vulnerability, CVE-2025-10035, is described as a deserialization flaw in the License Servlet that could lead to authentication-free command injection, affecting GoAnywhere versions 7.8.4 and Sustain Release 7.6.3 released by Fortra last week to remediate the problem.

An analysis released by watchTowr details how a crafted HTTP GET request to the /goanywhere/license/Unlicensed[.]xhtml/ endpoint can interact with the License Servlet exposed at /goanywhere/lic/accept/<GUID>, enabling exploitation via embedded GUIDs.

A pre-authentication chain, including an access-control bypass and unsafe deserialization, was noted by Rapid7 in its findings, with further evidence of in-the-wild activity such as the creation of a backdoor account and the use of a compromised GoAnywhere instance to upload payloads. The activity appears to originate from IP address 155.2.190[.]197, which has been flagged for brute-forcing Fortinet FortiGate SSL VPN appliances, underscoring the real-world risk. Fortra has released a critical patch, and users are urged to apply it promptly to mitigate ongoing exploitation.