Fortra GoAnywhere MFT CVE-2025-10035 Command Injection Vulnerability

Description

Deserialization vulnerability in Fortra GoAnywhere MFT's License Servlet allows an actor with a forged license signature to deserialize arbitrary objects, potentially enabling command injection.

Outbreak Alert

A critical deserialization vulnerability in GoAnywhere MFT’s License Servlet (CVSS 10.0) is actively being exploited in the wild. The flaw allows attackers with a forged license response signature to deserialize arbitrary objects, which can lead to command injection and remote code execution (RCE). FortiGuard telemetry shows sustained, high-volume exploitation attempts against GoAnywhere MFT instances.

View the full Outbreak Alert Report

Affected Applications

GoAnywhere MFT

References