Fortra Releases Critical Patch for CVSS 10.0 GoAnywhere MFT Vulnerability
Summary: Fortra disclosed a deserialization vulnerability in the License Servlet of GoAnywhere MFT, tracked as CVE-2025-10035 with a CVSS score of 10.0, that allows an actor with a validly forged license response signature to deserialize an arbitrary object and possibly achieve command injection. Fortra says exploitation depends on the system being publicly accessible over the internet, and users are advised to update to version 7.8.4 or Sustain Release 7.6.3, or otherwise restrict public access to the GoAnywhere Admin Console.
Bottom line: The flaw sits in the same license code path as CVE-2023-0669, which LockBit and other ransomware and APT groups exploited as a zero-day in 2023, and watchTowr's Ryan Dewhurst notes thousands of GoAnywhere MFT instances are internet-exposed and generally internet-facing by design.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2023-0669CVE-2024-0204CVE-2025-10035
- Related