Fortra.GoAnywhere.MFT.CVE-2025-10035.Command.Injection

Description

This indicates an attack attempt to exploit a Command Injection vulnerability in Fortra GoAnywhere MFT.
The vulnerability is due to insufficient validation of user-supplied input in the application. A remote attacker can exploit this with a crafted request to execute arbitrary commands within the context of the system.

Outbreak Alert

A critical deserialization vulnerability in GoAnywhere MFT’s License Servlet (CVSS 10.0) is actively being exploited in the wild. The flaw allows attackers with a forged license response signature to deserialize arbitrary objects, which can lead to command injection and remote code execution (RCE). FortiGuard telemetry shows sustained, high-volume exploitation attempts against GoAnywhere MFT instances.

View the full Outbreak Alert Report

Affected Products

Fortra GoAnywhere MFT prior to 7.8.4
Fortra GoAnywhere MFT 7.6.x prior to 7.6.3

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
https://www.fortra.com/security/advisories/product-security/fi-2025-012