Fortra GoAnywhere CVSS 10 Flaw Exploited as 0-Day a Week Before Public Disclosure
Summary: watchTowr Labs reported credible evidence that CVE-2025-10035, a CVSS 10.0 deserialization flaw in Fortra GoAnywhere MFT's License Servlet allowing unauthenticated command injection, was exploited in the wild as early as September 10, 2025, a week before public disclosure. Fortra released version 7.8.4 and Sustain Release 7.6.3 to fix it, and CISA confirmed active exploitation and set an October 20, 2025 patch deadline for federal agencies.
Bottom line: Attackers had a week's head start on a CVSS 10.0 flaw in software long favored by APT groups and ransomware operators, and watchTowr says it cannot explain how exploitation works without scenarios including attackers gaining control of private keys owned by Fortra.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-10035
- Related