Fortra addressed a maximum severity flaw in GoAnywhere MFT software

Fortra addressed a maximum severity flaw in GoAnywhere MFT software, tracked as CVE-2025-10035 with a CVSS score of 10.0, described as a deserialization vulnerability in the License Servlet that could allow an attacker to execute arbitrary commands on affected systems.

According to Fortra’s advisory, a deserialization vulnerability in the License Servlet of Fortra’s GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection. The company urges customers to upgrade to the patched version 7.8.4 or the Sustain Release 7.6.3, and to mitigate by restricting public access to the GoAnywhere Admin Console since exploitation depends on internet exposure.

The article notes that it is unclear whether the vulnerability has been actively exploited in the wild and recalls a separate January 2024 vulnerability, CVE-2024-0204, an authentication bypass that could create admin users via the appliance administration portal. It also mentions Horizon3’s Attack Team published technical details of CVE-2024-0204, linking to prior warnings issued by Fortra in December 2023.