Loading story…
Fortra released security updates for GoAnywhere MFT to fix CVE-2025-10035, a critical deserialization flaw in the product's License Servlet that can let a remote, unauthenticated attacker inject commands and take full control of vulnerable systems. The issue carries a CVSS v3.1 score of 10.0 and affects 7.8.x before 7.8.4 and 7.6.x before Sustain Release 7.6.3, with internet-exposed administrative consoles facing the highest risk.
CSIRT.SK reported the vulnerability is actively exploited and may have been abused since at least 2025-09-10. Defenders were urged to upgrade immediately, restrict administrative access through firewall rules or VPNs, and review Admin Audit and application logs for indicators of compromise, including errors containing SignedObject.getObject.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Public reporting described CVE-2025-10035 as a critical deserialization vulnerability in GoAnywhere MFT's License Servlet with a CVSS v3.1 score of 10.0. The issue was noted as actively exploited, with guidance to upgrade immediately and restrict administrative console exposure.
Fortra released security updates to address CVE-2025-10035, a critical vulnerability in the GoAnywhere MFT License Servlet. The fixes cover affected 7.8.x versions before 7.8.4 and 7.6.x versions before Sustain Release 7.6.3.
CSIRT.SK reported that the critical deserialization flaw in GoAnywhere MFT had been exploited in the wild since at least September 10, 2025. The vulnerability affects the License Servlet and can allow unauthenticated remote command injection and full system compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortra has disclosed CVE-2025-10035, a critical deserialization vulnerability in GoAnywhere MFT's License Servlet, allowing remote attackers to achieve command injection with a forged license response signature. The flaw is rated CVSS 10.0 and is exploitable if the admin console is exposed to the internet. No active exploitation has been confirmed, but the product's history and exposure make immediate patching and mitigation essential.
Jun 29, 2026
A critical authentication bypass vulnerability in **Fortra GoAnywhere MFT** allows unauthenticated attackers to create a new administrative user by directly accessing the ` /InitialAccountSetup.xhtml ` endpoint. Tracked as **`CVE-2024-0204`**, the flaw stems from improper path normalization and affects versions earlier than **7.4.1**. Public reporting said most observed internet-exposed instances were still running vulnerable releases, raising the risk of opportunistic compromise. Fortra and defenders urged organizations to upgrade immediately to **GoAnywhere MFT 7.4.1 or later**. As a temporary mitigation for non-containerized deployments, administrators were advised to remove the vulnerable setup page and restart services: ```bash rm -f $GOANYWHERE_INSTALL_DIR/adminroot/WEB-INF/classes/com/linoma/ga/ui/admin/InitialAccountSetup.xhtml ``` The issue was identified by Mohammed Eldeeb and Islam Elrfai of Spark Engineering Consultants, and technical analysis showed the bug could be abused to regain access to an initialization workflow that should no longer be reachable after first-time setup.
Jul 24, 2026
A critical vulnerability, CVE-2025-10035, was discovered in Fortra's GoAnywhere Managed File Transfer (MFT) solution, specifically affecting the License Servlet Admin Console in versions up to 7.8.3. This flaw is a deserialization vulnerability that allows attackers to bypass signature verification by crafting a forged license response signature, enabling the deserialization of arbitrary, attacker-controlled objects. Successful exploitation can result in command injection and remote code execution (RCE) on affected systems. The vulnerability is particularly dangerous for internet-exposed instances, as exploitation does not require authentication if attackers can craft or intercept valid license responses. Fortra released a patch for the vulnerability on September 18, 2025, but did not initially disclose that it was being actively exploited. Security researchers at WatchTowr Labs later confirmed that the vulnerability had been exploited as a zero-day since at least September 10, 2025. Microsoft Threat Intelligence identified a cybercriminal group, Storm-1175, known for deploying Medusa ransomware, as actively exploiting this vulnerability in attacks against multiple organizations. The attackers used the vulnerability for initial access, then maintained persistence by abusing remote monitoring and management (RMM) tools such as SimpleHelp and MeshAgent. They conducted network reconnaissance using Netscan, performed user and system discovery, and moved laterally within compromised networks using Microsoft Remote Desktop Connection (mstsc.exe). In at least one case, the attackers deployed Rclone to facilitate data exfiltration. The Shadowserver Foundation reported monitoring over 500 GoAnywhere MFT instances exposed online, raising concerns about the potential scale of impact. Microsoft and other security experts have urged organizations to immediately patch affected systems, review license verification mechanisms, and implement additional hardening measures. Microsoft Defender provides detection and protection coverage for this threat, and organizations are advised to monitor for signs of compromise and unusual activity related to GoAnywhere MFT. The exploitation campaign highlights the ongoing risk posed by critical vulnerabilities in widely used file transfer solutions and the speed with which ransomware affiliates can weaponize such flaws. Organizations that have not yet applied the patch or reviewed their exposure are at significant risk of compromise. The incident underscores the importance of rapid vulnerability management and the need for layered security controls to detect and respond to sophisticated threat actors. Security advisories recommend not only patching but also reviewing access logs, monitoring for suspicious RMM tool usage, and restricting internet exposure of sensitive administrative interfaces. The coordinated response from vendors and the security community has been crucial in raising awareness and providing actionable guidance to mitigate the threat.
Jun 29, 2026