CVE DatabaseCVE-2025-10035

Updated 2026-10-18한국어 권고문 →

CVE-2025-100359.8/CRITICALCISA KEVCWE-77CWE-502CWE-77CWE-502

Fortra GoAnywhere MFT License Servlet Deserialization and Remote Code Execution (RCE) Security Advisory (CVE-2025-10035)

⚡ Jump to Patch

Affected Vendors

fortra

Affected Components

goanywhere mft

Published Date

2025-09-18

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

99.8%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

License Servlet component of Fortra GoAnywhere MFT

Impact

Unauthenticated attackers with a validly forged license response signature can deserialize arbitrary objects, potentially leading to remote command injection and full system compromise

Mitigation

Immediately apply the official security patches provided by Fortra and restrict external access to the license servlet interfaces

Affected Products & Version Scope

All Fortra GoAnywhere MFT deployments utilizing the License Servlet prior to the patched versions specified in Fortra Advisory FI-2025-012

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official security update from the Fortra Customer Portal. Below is an example of stopping the service and applying the patch on a Linux-based GoAnywhere MFT deployment.

bash

# Stop the GoAnywhere MFT service
sudo systemctl stop goanywhere-mft

# Extract and execute the official patch installer	ar -zxvf goanywhere_patch_fi_2025_012.tar.gz
cd goanywhere_patch_fi_2025_012
sudo ./install_patch.sh

# Restart the service and verify status
sudo systemctl start goanywhere-mft
sudo systemctl status goanywhere-mft

2. Temporary Workaround & Hardening Configuration

If patching cannot be performed immediately, block external access to the License Servlet endpoint using an Nginx reverse proxy or web application firewall (WAF).

nginx

# Nginx configuration to block external access to the License Servlet
server {
    listen 443 ssl;
    server_name mft.company.local;

    # Block access to the vulnerable License Servlet path
    location ~* ^/goanywhere/.*LicenseServlet {
        deny all;
        return 403;
    }

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
    }
}

3. Log Audit & IoC Verification Commands

Inspect GoAnywhere MFT system logs for suspicious POST requests targeting the License Servlet or Java deserialization error traces.

bash

# Search for access logs targeting the License Servlet
grep -i 'LicenseServlet' /opt/HelpSystems/GoAnywhere/userdata/log/*.log

# Scan for Java deserialization exceptions and common gadget indicators
grep -E 'ObjectInputStream|readObject|InvokerTransformer' /opt/HelpSystems/GoAnywhere/userdata/log/*.log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation in the wild (CISA KEV), prioritize immediate patching of all GoAnywhere MFT instances.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-10035) is an untrusted data deserialization flaw (CWE-502) residing within the License Servlet of Fortra's GoAnywhere MFT. The root cause stems from the application's failure to properly validate and sanitize serialized object streams received during license verification processes. When the system processes a license response, it deserializes the payload without sufficient restrictions, allowing for arbitrary object instantiation.

2. Exploitation Mechanics & Attack Scenario

An attacker targets the exposed License Servlet endpoint. By forging a valid license response signature, the attacker bypasses initial signature validation checks. Once validated, the application attempts to deserialize the accompanying payload. By embedding malicious gadget chains (such as those targeting common Java libraries) within the serialized stream, the attacker triggers arbitrary command execution (CWE-77) under the security context of the GoAnywhere MFT process.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an immediate and severe threat to enterprise infrastructure. Successful exploitation grants unauthenticated remote code execution, enabling threat actors to exfiltrate sensitive files, deploy ransomware, or establish a persistent foothold within the internal corporate network.

Official Vendor Advisories & References

NVD Original English Description

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

https://www.fortra.com/security/advisories/product-security/fi-2025-012

Source: df4dee71-de3a-4139-9588-11b62fe6c0ff · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10035

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2025-10035)

FAQ

Q1. How critical is CVE-2025-10035 and is it actively exploited in the wild?

CVE-2025-10035 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-10035?

Primary impacted vendors include fortra across goanywhere mft. Scope summary: All Fortra GoAnywhere MFT deployments utilizing the License Servlet prior to the patched versions specified in Fortra Advisory FI-2025-012

Q3. What temporary mitigations or workarounds exist for CVE-2025-10035 before patching?

[Mitigation] Immediately apply the official security patches provided by Fortra and restrict external access to the license servlet interfaces Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION