Fortra GoAnywhere MFT Command Injection (CVE-2025-10035)

Historical catalog analysis: CISA added this entry on September 29, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-10035 is a deserialization of untrusted data vulnerability (CWE-502) affecting Fortra GoAnywhere MFT. The flaw allows an actor who possesses a validly forged license response signature to deserialize an arbitrary object controlled by the actor. This process could potentially lead to command injection (CWE-77), enabling unauthorized code execution on the affected system.

Exposure and applicability

This vulnerability applies to organizations deploying Fortra GoAnywhere MFT. The attack vector is specific: it requires the ability to provide a forged license response signature to trigger the deserialization of the malicious object. Because this vulnerability has been identified as known for use in ransomware campaigns, exposure represents a high-priority risk for infrastructure owners managing managed file transfer (MFT) services.

Remediation priorities

Based on the reported exploitation patterns, we analyze the following prioritization for defenders:

1. Immediate Asset Identification: Identify all instances of GoAnywhere MFT across the environment, including cloud-hosted and on-premises deployments.
2. Vendor Mitigation Application: Apply the specific mitigations provided in the vendor’s security advisory (FI-2025-012). For those utilizing cloud services, adherence to BOD 22-01 guidance is recommended.
3. Decommissioning Evaluation: In scenarios where mitigations cannot be applied or are unavailable for a specific version, the source suggests discontinuing use of the product to eliminate the exposure path.

How to validate remediation

Verification must go beyond confirming a software version number. To assure that the vulnerability is mitigated, defenders should focus on the license response mechanism:

• Configuration Audit: Verify that the system no longer accepts or processes the specific type of forged license response signatures associated with this flaw.
• Integrity Check: Ensure that the update or mitigation applied specifically addresses the deserialization path used for license validation.
• Log Analysis: Review system logs for any anomalous license-related activity or unexpected object deserialization attempts that occurred prior to and immediately following the fix.

Limits and open questions

Applying a patch or configuration change reduces the likelihood of exploitation but does not guarantee total immunity if other unknown entry paths exist. A primary residual risk remains the potential for existing persistence if the system was compromised via this vulnerability before remediation was applied. It remains unclear exactly how a “validly forged license response signature” is obtained or generated, which limits the ability to create specific detection signatures for the forgery attempt itself without further vendor technical data.

Source and editorial note

CVE-2025-10035: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability · Source date: September 29, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: October 02, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 01, 2026 at 01:25 UTC.

Request a Vulnerability Assessment