CVE-2025-10035: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability

CVE-2025-10035 is a deserialization of untrusted data vulnerability in Fortra GoAnywhere MFT, a managed file transfer product. An attacker who can supply a validly forged license response signature may cause the software to deserialize an arbitrary object under their control, which can lead to command injection. This matters because successful exploitation can give an attacker a foothold on the host running GoAnywhere MFT, and the vulnerability is known to have been used in ransomware operations. Defenders should treat exposed or internet-facing instances as high priority and confirm all details against the vendor advisory.

How it works

The core weakness is CWE-502 (deserialization of untrusted data), which can chain into CWE-77 (command injection). In this case, the product processes license-related responses. If an attacker forges a license response that carries a valid signature, the application may deserialize an object the attacker controls. Deserialization of untrusted data is a well-known class of flaw: the runtime reconstructs objects from attacker-supplied data, and if those objects include gadgets or callbacks that execute system commands, the result is remote code execution or command injection on the server. Public detail on the exact object graph or signature-forging method is limited; treat the CISA description as the authoritative high-level summary and verify technical mechanics only against Fortra’s advisory. No exploit code or version-specific trigger details are provided here.

Am I affected? How to find it in your systems

GoAnywhere MFT is typically deployed as an on-premises or cloud-hosted managed file transfer gateway used for secure file exchange with partners, customers, or internal systems. It often sits at the network edge or in a DMZ and may be reachable over HTTPS or other transfer protocols.

• Inventory: Search asset management, CMDB, and vulnerability scanners for “GoAnywhere,” “Fortra GoAnywhere MFT,” or related service names and process binaries. Check both production and non-production environments.
• Version and configuration: Identify the installed release and any license-validation or update-related settings. Exact affected versions are not listed in the provided facts; compare your build numbers directly to the vendor advisory.
• Exposure: Note whether the management interface or license-related endpoints are internet-facing or reachable from untrusted networks.
• Telemetry: Look for anomalous license-validation traffic, unexpected deserialization errors, or process launches (shells, scripting interpreters) spawned by the GoAnywhere service account. Correlate with authentication and file-transfer logs for unusual activity around the time of any suspected license events.

If you cannot confirm the version or patch status, assume the instance is potentially vulnerable until proven otherwise against the advisory.

How to remediate

Patch first. Apply the mitigations and updates published by Fortra for CVE-2025-10035 exactly as described in the vendor instructions. CISA’s required action is to apply those mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. After patching, restart services as directed, re-validate license and configuration state, and re-scan to confirm the vulnerability is no longer reported. Document the change and retain evidence of the update for audit and incident-response purposes. Hardening steps that reduce risk for this class of flaw include restricting which accounts can perform license or administrative operations, ensuring the service runs with least privilege, and disabling any unused license or update channels if the vendor permits it.

If you can't patch immediately

Until the vendor update can be applied, reduce the attack surface with compensating controls:

• Network segmentation: Place GoAnywhere MFT behind strict firewall rules or a reverse proxy so that only trusted management and transfer clients can reach it; block direct internet access to administrative and license-related endpoints where possible.
• Virtual patching / WAF: Deploy web-application firewall or IPS rules that detect and block anomalous license-response or deserialization payloads, guided by any signatures the vendor or CISA may publish. Confirm rule efficacy against the advisory.
• Feature disablement: If the product allows, temporarily disable or tightly control license-validation or remote-update features that process untrusted signed responses.
• Monitoring and detection: Increase logging verbosity for the GoAnywhere service, alert on unexpected child processes, outbound connections from the service account, and failed or unusual license events. Retain logs for forensic review.
• Cloud instances: Follow BOD 22-01 guidance for cloud services, including rapid isolation or replacement if patching is delayed.

These measures lower risk but do not eliminate it; schedule the official patch as soon as operationally feasible.

If your data may have been exposed

Actively exploited vulnerabilities, especially those known to be used by ransomware operators, frequently lead to data theft or encryption. If you discover evidence of exploitation or cannot rule it out, treat the incident as a potential breach: isolate affected systems, preserve logs and disk images, and engage your incident-response process. Review file-transfer logs for unauthorized exfiltration and check whether credentials or partner data stored in or processed by GoAnywhere MFT may have been accessed. As a quick personal check, you can run a free exposure scan of your email address against known breach data sets to see whether related accounts appear in public dumps. Continue to follow the vendor advisory and CISA guidance for any additional recovery steps.