Loading story…
Fortra has disclosed CVE-2025-10035, a critical deserialization vulnerability in GoAnywhere MFT's License Servlet, allowing remote attackers to achieve command injection with a forged license response signature. The flaw is rated CVSS 10.0 and is exploitable if the admin console is exposed to the internet. No active exploitation has been confirmed, but the product's history and exposure make immediate patching and mitigation essential.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository named 'CVE-2025-10035_GoAnywhere' was published, indicating public release of exploit code or a proof-of-concept for remote code execution against the GoAnywhere MFT flaw. This lowered the barrier to exploitation beyond prior research and reporting about the vulnerability.
Multiple outlets reported that CVE-2025-10035 had been exploited in the wild roughly a week before its public disclosure and patch release. This shifted the incident from a critical vulnerability disclosure to a confirmed zero-day exploitation case.
Subsequent reporting warned that large numbers of GoAnywhere deployments remained exposed and vulnerable if unpatched, increasing concern about broad exploitation potential. This marked an escalation from initial disclosure to ecosystem-wide exposure assessment.
WatchTowr published technical research examining the vulnerability and its exploitability, expanding public understanding of the attack path. The research helped clarify why the issue was especially dangerous for exposed administrative interfaces.
Following disclosure, security researchers and defenders published analysis of the bug, warned that internet-exposed admin consoles were at highest risk, and shared methods to identify exposed GoAnywhere MFT instances. Researchers also noted exploitation likely required access to a private key or another unknown enabling factor.
Fortra disclosed CVE-2025-10035, a maximum-severity deserialization flaw in GoAnywhere MFT's License Servlet that can enable command injection, and released fixed versions 7.8.4 and 7.6.3. The company advised customers to patch immediately and restrict internet exposure of the admin console.
Microsoft later attributed exploitation of CVE-2025-10035 to Storm-1175 beginning on 2025-09-11, indicating the flaw was used as a zero-day before public disclosure. At least one observed intrusion led to Medusa ransomware deployment.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
23 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcegithub.com
Open sourcecisecurity.org
Open sourcebleepingcomputer.com
Open sourcecyberscoop.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortra released security updates for **GoAnywhere MFT** to fix **`CVE-2025-10035`**, a critical deserialization flaw in the product's **License Servlet** that can let a remote, unauthenticated attacker inject commands and take full control of vulnerable systems. The issue carries a **CVSS v3.1 score of 10.0** and affects **7.8.x before 7.8.4** and **7.6.x before Sustain Release 7.6.3**, with internet-exposed administrative consoles facing the highest risk. CSIRT.SK reported the vulnerability is **actively exploited** and may have been abused since at least **2025-09-10**. Defenders were urged to upgrade immediately, restrict administrative access through firewall rules or VPNs, and review Admin Audit and application logs for indicators of compromise, including errors containing **`SignedObject.getObject`**.
Jul 24, 2026
A critical vulnerability, CVE-2025-10035, was discovered in Fortra's GoAnywhere Managed File Transfer (MFT) solution, specifically affecting the License Servlet Admin Console in versions up to 7.8.3. This flaw is a deserialization vulnerability that allows attackers to bypass signature verification by crafting a forged license response signature, enabling the deserialization of arbitrary, attacker-controlled objects. Successful exploitation can result in command injection and remote code execution (RCE) on affected systems. The vulnerability is particularly dangerous for internet-exposed instances, as exploitation does not require authentication if attackers can craft or intercept valid license responses. Fortra released a patch for the vulnerability on September 18, 2025, but did not initially disclose that it was being actively exploited. Security researchers at WatchTowr Labs later confirmed that the vulnerability had been exploited as a zero-day since at least September 10, 2025. Microsoft Threat Intelligence identified a cybercriminal group, Storm-1175, known for deploying Medusa ransomware, as actively exploiting this vulnerability in attacks against multiple organizations. The attackers used the vulnerability for initial access, then maintained persistence by abusing remote monitoring and management (RMM) tools such as SimpleHelp and MeshAgent. They conducted network reconnaissance using Netscan, performed user and system discovery, and moved laterally within compromised networks using Microsoft Remote Desktop Connection (mstsc.exe). In at least one case, the attackers deployed Rclone to facilitate data exfiltration. The Shadowserver Foundation reported monitoring over 500 GoAnywhere MFT instances exposed online, raising concerns about the potential scale of impact. Microsoft and other security experts have urged organizations to immediately patch affected systems, review license verification mechanisms, and implement additional hardening measures. Microsoft Defender provides detection and protection coverage for this threat, and organizations are advised to monitor for signs of compromise and unusual activity related to GoAnywhere MFT. The exploitation campaign highlights the ongoing risk posed by critical vulnerabilities in widely used file transfer solutions and the speed with which ransomware affiliates can weaponize such flaws. Organizations that have not yet applied the patch or reviewed their exposure are at significant risk of compromise. The incident underscores the importance of rapid vulnerability management and the need for layered security controls to detect and respond to sophisticated threat actors. Security advisories recommend not only patching but also reviewing access logs, monitoring for suspicious RMM tool usage, and restricting internet exposure of sensitive administrative interfaces. The coordinated response from vendors and the security community has been crucial in raising awareness and providing actionable guidance to mitigate the threat.
Jun 29, 2026
A critical authentication bypass vulnerability in **Fortra GoAnywhere MFT** allows unauthenticated attackers to create a new administrative user by directly accessing the ` /InitialAccountSetup.xhtml ` endpoint. Tracked as **`CVE-2024-0204`**, the flaw stems from improper path normalization and affects versions earlier than **7.4.1**. Public reporting said most observed internet-exposed instances were still running vulnerable releases, raising the risk of opportunistic compromise. Fortra and defenders urged organizations to upgrade immediately to **GoAnywhere MFT 7.4.1 or later**. As a temporary mitigation for non-containerized deployments, administrators were advised to remove the vulnerable setup page and restart services: ```bash rm -f $GOANYWHERE_INSTALL_DIR/adminroot/WEB-INF/classes/com/linoma/ga/ui/admin/InitialAccountSetup.xhtml ``` The issue was identified by Mohammed Eldeeb and Islam Elrfai of Spark Engineering Consultants, and technical analysis showed the bug could be abused to regain access to an initialization workflow that should no longer be reachable after first-time setup.
Jul 24, 2026